You need to use parameters instead of just concatenating together your SQL: using (SqlConnection con = new SqlConnection(–your-connection-string–)) using (SqlCommand cmd = new SqlCommand(con)) { string query = “SELECT distinct ha FROM app WHERE 1+1=2”; if (comboBox1.Text != “”) { // add an expression with a parameter query += ” AND firma = @value1 “; … Read more
A parameterized query (also known as a prepared statement) is a means of pre-compiling a SQL statement so that all you need to supply are the “parameters” (think “variables”) that need to be inserted into the statement for it to be executed. It’s commonly used as a means of preventing SQL injection attacks. You can … Read more
Parameterized queries do proper substitution of arguments prior to running the SQL query. It completely removes the possibility of “dirty” input changing the meaning of your query. That is, if the input contains SQL, it can’t become part of what is executed because the SQL is never injected into the resulting statement.