SQL in a c# Code Where clause issues

Asked Mar 04 '16 at 16:24

Active Mar 04 '16 at 16:24

Viewed 36 times

I have an array of integers say array = [1,2,3,4,5,6,7,8,9];

The array of integers is created from an array of strings using this command

int[] array = Array.ConvertAll(arr, int.Parse);

I am trying to extract some data from the database db1

sql = $"SELECT col1, col2 from dbo.databas1 WHERE col1 in array";

I am fairly certain that my SQL code is wrong towards the end in the where clause. Can anyone tell me how implement the where clause in the SQL code?

Col1 is bigint (if it is of any help)

asked Mar 04 '16 at 16:24

Morpheus

1

`sql = string.Format("SELECT col1, col2 from dbo.databas1 WHERE col1 in {0}", array.join(','))` – believe me Mar 04 '16 at 16:27
1

Don't build SQL through string concatenation. That being said, parameterizing `IN` is hard, and requires ... string concatenation. See [Parameterize an SQL IN clause](http://stackoverflow.com/questions/337704/parameterize-an-sql-in-clause). – CodeCaster Mar 04 '16 at 16:27
@believeme bad idea. – Daniel A. White Mar 04 '16 at 16:27
@CodeCaster - arguably not a huge issue if there is a validation that all parameters are indeed integers - however you never know when someone will change them to string and you can have sql injection problem :) – Ondrej Svejdar Mar 04 '16 at 16:30
@DanielA.White you're right but this just answers OP's question in his own way – believe me Mar 04 '16 at 16:30
@CodeCaster Or you can use a User Defined Table Type – juharr Mar 04 '16 at 16:33
@believeme My array doesn't have a .join method? – Morpheus Mar 04 '16 at 16:44
@Morpheus sure it does, it depends how your code is written – believe me Mar 04 '16 at 16:51

0 Answers0