Author: Ushtabalakh | Posted on: 3/24/2009 6:32:31 PM | Views : 1299

 I'm trying to to have a a parametrized sql command to make it immune to sql injection and other threats, that would use a sql like command in it
If I use where (column_StdFamily like "somestring%") it will work, but using the following code it doesn't return any results

How am I supposed to do this? where do I need to put the %?

 

Dim strSQLQuery As String = "select column_id from table_searchenteries where (column_StdFamily like @strFamilyNameReverseFirst6)" Dim nonqueryCommand1 As SqlCommand = objDatabase.MainConnection.CreateCommand()
nonqueryCommand1.CommandText = strSQLQuery
nonqueryCommand1.Parameters.Add("@strFamilyNameRevers ...

Go to the complete details ...