Click here to Skip to main content
15,886,701 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
hi,

my codes like this i use viwth oracle


SELECT * FROM GENTM02 WHERE ID=84 AND KOD IN(1,2,3,4)


bu i want use this codes like this


SELECT * FROM GENTM02 WHERE ID=84 AND KOD IN("& textbox1.value &")



textbox1.value is "1,2,3,4"

What I have tried:

SELECT * FROM GENTM02 WHERE ID=84 AND KOD IN("& textbox1.value &")


or another one is

SELECT * FROM GENTM02 WHERE ID=84 AND KOD IN( SELECT DEGER2 FROM GENTM03 WHERE ID=16 AND KOD2=3 )

In this code "DEGER2" value is "1,2"
Posted
Updated 25-Aug-21 20:46pm
v2

Not like that! Your code will be vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

It's not quite so simple to do that with an IN query, but it's not too bad - for example:
C#
using (var connection = new SqlConnection("..."))
using (var command = new SqlCommand("", connection))
{
    var sb = new StringBuilder("SELECT * FROM GENTM02 WHERE ID = @ID");
    command.Parameters.AddWithValue("@ID", 84);
    
    var parameterNames = new List<string>();
    foreach (string part in textbox1.Text.Split(","))
    {
        string name = "@KOD" + parameterNames.Count;
        command.Parameters.AddWithValue(name, part);
        parameterNames.Add(name);
    }
    
    if (parameterNames.Count != 0)
    {
        sb.AppendFormat(" AND KOD IN ({0})", string.Join(", ", parameterNames);
    }
    
    command.CommandText = sb.ToString();
    
    var ds = new DataSet();
    var da = new SqlDataAdapter(command);
    da.Fill(ds);
    
    // Use the data...
}
 
Share this answer
 
Not safely, and not directly.
If you concatenate strings as in your example, you leave yourself wide open to SQL Injection, which risks your DB being damaged or deleted.
If you pass the string as a parameter, it won't work.

There is a safe solution, but it's not trivial: Using comma separated value parameter strings in SQL IN clauses[^] - the code is SQL Server, but the Oracle equivalent shouldn't be too different.
 
Share this answer
 
i used "instr" function with my query


i solved my question

thanks everybody
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900