C# Microsoft SQL

Question

I want to write that two strbldrSQL.Append in single strbldrSQL. Because Im inserting records in 2 DataSets dsorderHeader and dsorderDetail respectively.

if (strbldrSQL != null) strbldrSQL.Clear();
else strbldrSQL = new StringBuilder();

strbldrSQL.Append(@" SELECT ORDHEDR01.* FROM ORDHEDR01 "
                 + " WHERE ORDHEDR01.COMPANY = " + argintCompany + " "
                 + " AND ORDHEDR01.WHSE = " + argintWarehouse + " "
                 + " AND ORDHEDR01.ORDNUM = " + arglngOrderNumber + " "                                 
                 );


dsOrderHeader = DAL.pfGetDataSet(ref argobjMnCnnCls, strbldrSQL.ToString(), true);

if (dsOrderHeader == null) return CNS.gcUpdateFailed + ";" + "Unable to get data";

strbldrSQL.Clear();

strbldrSQL.Append(@" SELECT ORDDETL02.* FROM ORDDETL02 "
                + " WHERE ORDDETL02.COMPANY = " + argintCompany + " "
                + " AND ORDDETL02.WHSE = " + argintWarehouse + " "
                + " AND ORDDETL02.ORDNUM = " + lngOrderNumber + " "
               );

dsOrderDetail = DAL.pfGetDataSet(ref argobjMnCnnCls, strbldrSQL.ToString(), true);

if (dsOrderDetail == null) return CNS.gcUpdateFailed + ";" + "Unable to get data";

_What_ do you want? In general, don't concatenate sql strings to build a sql query but use parameterized queries to avoid sql injection and other issues(f.e. wrong conversions). — Tim Schmelter, Oct 15 '15 at 09:41
You need to add more details as to what you are trying to achieve? — Rahul Tripathi, Oct 15 '15 at 09:42
Your code is a prime target for [SQL Injection](http://stackoverflow.com/a/332367/1663001) — DavidG, Oct 15 '15 at 09:45
that 2 strbldrSQL.Append statements should be written in 1 strbldrSQL.Append — priya, Oct 15 '15 at 09:46

C# Microsoft SQL

0 Answers0