CODEWITHSUNDEEP
c#sqloracle-databaseado.net
Amit Toren
Amit Toren

Reputation: 351

Can't run oracle command with a specific where c#

I needed to run this query:

"Select column_name from all_tab_columns 
where table_name=''" + tableName + " owner='" + ownerName + "'";

This is running it as an OracleCommand in C#. It didn't work. I tried many variations including different variables but it never works when I put table_name in the where clause. It's not because I'm not using LIKE either.

Upvotes: 0

Views: 107

Answers (1)

Cee McSharpface
Cee McSharpface

Reputation: 8726

A properly formatted command text would have to look something like this:

var query = String.Format(@"
    SELECT 
        column_name 
    FROM all_tab_columns 
    WHERE table_name='{0}'
    AND owner='{1}'", tableName, ownerName);

This is vulnerable to injection attacks if tableName and ownerName were user input. In this case, use a parametrized command instead:

var query = @"
    SELECT 
        column_name 
    FROM all_tab_columns 
    WHERE table_name=:tablename'
    AND owner=:ownername";

The values are then assigned using OracleParameter instances.

Upvotes: 1

Related Questions