how to pass two variables in sql command in C#? -
really simple question , have 2 variables "one_hour_ago" , "current_time", need pass these 2 variables in sql command :
string commandstring = "select * mytable time between one_hour_ago , current_time"; here have syntax error
string commandstring = "select * mytable ts between ' , /" + one_hour_ago + "'" + current_time + "/"; thanks
string sqlstring = "select * mytable time between @before , @current_time"; sqlcommand ocmd = new sqlcommand(sqlstring , connstring); ocmd.parameters.addwithvalue("@before", date_before); ocmd.parameters.addwithvalue("@current_time", currenttime); where date_before , currenttime parameters pass method.
this should take care of sql injection stuff
Comments
Post a Comment