I am using the parameterized select query for querying the mysql database. And below is the c# code I am using
public static void ValidateName(MySqlConnection conn,List<Employee> EmpList, string Grp)
{
string selectQuery = "Select Name from Employee where Group = @Group AND @Name in (FirstName, LastName);";
using (MySqlCommand cmd = new MySqlCommand(selectQuery, conn))
{
for (int i = 0; i < EmpList.Count; i++)
{
cmd.Parameters.Add("@Group", MySqlDbType.VarChar).Value = Grp;
cmd.Parameters.Add("@Name", MySqlDbType.VarChar).Value = EmpList[i].Name;
var reader = cmd.ExecuteReader();
List<string> lineList = new List<string>();
while (reader.Read())
{
lineList.Add(reader.GetString(0));
}
if (lineList.Count <=0)
{
WriteValidationFailure(EmpList[i], "Failed");
}
}
}
}
What is the benefit of using the cmd.Prepare(); does that improve my code in any ways. Also I need to know if I am having multiple functions like above in my program and everytime giving using (MySqlCommand cmd = new MySqlCommand(selectQuery, conn))
inside in the individual functions add any complexity to the code? I am new to creating database connection from the c# and not sure about how much complexity my code adds.