how to pass two variables in sql command in C#? -


really simple question , have 2 variables "one_hour_ago" , "current_time", need pass these 2 variables in sql command :

string commandstring = "select * mytable time between one_hour_ago , current_time"; 

here have syntax error

string commandstring = "select * mytable ts between ' , /" + one_hour_ago + "'" + current_time + "/";  

thanks

string sqlstring = "select * mytable time between  @before , @current_time";  sqlcommand ocmd = new sqlcommand(sqlstring , connstring); ocmd.parameters.addwithvalue("@before", date_before); ocmd.parameters.addwithvalue("@current_time", currenttime); 

where date_before , currenttime parameters pass method.

this should take care of sql injection stuff


Comments

Popular posts from this blog

java - Play! framework 2.0: How to display multiple image? -

gmail - Is there any documentation for read-only access to the Google Contacts API? -

php - Controller/JToolBar not working in Joomla 2.5 -