根据ASP.NET文本字段的内容选择SQL搜索字符串

Question

The goal of the code-behind below is to select a SQL SELECT statement in a string variable based on whether or not a text box is or is not null, then execute the statement. I've tried both using a variable and directly executing the SELECT statement using

SqlDataSource1.SelectCommand = 'SELECT...' 

Unfortunately, neither method is returning anything at all when I put data in the text fields to be checked.

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Data.Sql;

namespace MyProgram
{
    public partial class WebForm1 : System.Web.UI.Page
    {
       string query = "";

        protected void Page_Load(object sender, EventArgs e)
        {

            SqlDataSource1.SelectCommand = query;
            SqlDataSource1.SelectParameters.Add("NameLast", SearchLast.ToString());
            SqlDataSource1.SelectParameters.Add("NameFirst", SearchFirst.ToString());
            SqlDataSource1.SelectParameters.Add("SSN", SearchSSN.ToString());
            SqlDataSource1.SelectParameters.Add("DOB", SearchDOB.ToString());
            SqlDataSource1.SelectParameters.Add("Case", SearchCase.ToString());

        }

        protected void Button1_Click(object sender, EventArgs e)
        {

                if (SearchCase.Text != string.Empty)
                {
                    SqlDataSource1.SelectCommand = "SELECT CLTCAS,CLTLST+', '+CLTFST,DATEFROMPARTS(cltbyr,cltbmm,cltbdd),CLTCTY+', '+[ CLTSTA],CLTSSN,CLTSEX FROM CLTMST WHERE CLTCAS = @Case";
                }
                if (SearchSSN.Text != string.Empty && SearchSSN.Text.Length == 4 && SearchLast.Text == string.Empty && SearchFirst.Text == string.Empty)
                {
                    SqlDataSource1.SelectCommand = "SELECT CLTCAS,CLTLST+', '+CLTFST,DATEFROMPARTS(cltbyr,cltbmm,cltbdd),CLTCTY+', '+[ CLTSTA],CLTSSN,CLTSEX FROM CLTMST WHERE right(CLTSSN,4) = @SSN";
                }
                if (SearchSSN.Text != string.Empty && SearchSSN.Text.Length == 9 && SearchLast.Text != string.Empty && SearchFirst.Text == string.Empty)
                {
                    query = "SELECT CLTCAS,CLTLST+', '+CLTFST,DATEFROMPARTS(cltbyr,cltbmm,cltbdd),CLTCTY+', '+[ CLTSTA],CLTSSN,CLTSEX FROM CLTMST WHERE CLTSSN = @SSN";
                }
                if (SearchLast.Text != string.Empty && SearchFirst.Text != string.Empty && SearchDOB.Text == string.Empty && SearchSSN.Text == string.Empty)
                {
                    query = "SELECT CLTCAS,CLTLST+', '+CLTFST,DATEFROMPARTS(cltbyr,cltbmm,cltbdd),CLTCTY+', '+[ CLTSTA],CLTSSN,CLTSEX FROM CLTMST WHERE CLTLST = @NameLast and CLTFST like @NameFirst+'%'";
                }
                if (SearchLast.Text != string.Empty && SearchFirst.Text == string.Empty && SearchSSN.Text == string.Empty && SearchDOB.Text == string.Empty)
                {
                    query = "SELECT CLTCAS,CLTLST+', '+CLTFST,DATEFROMPARTS(cltbyr,cltbmm,cltbdd),CLTCTY+', '+[ CLTSTA],CLTSSN,CLTSEX FROM CLTMST WHERE CLTLST = @NameLast+'%'";
                }
                if (SearchLast.Text == string.Empty && SearchFirst.Text == string.Empty && SearchSSN.Text == string.Empty && SearchDOB.Text != string.Empty)
                {
                    query = "SELECT CLTCAS,CLTLST+', '+CLTFST,DATEFROMPARTS(cltbyr,cltbmm,cltbdd),CLTCTY+', '+[ CLTSTA],CLTSSN,CLTSEX FROM CLTMST WHERE (cltbyr+'-'+cltbmm+'-'+cltbdd = @DOB)";
                }
                if (SearchLast.Text != string.Empty && SearchFirst.Text == string.Empty && SearchSSN.Text == string.Empty && SearchDOB.Text != string.Empty)
                {
                    query = "SELECT CLTCAS,CLTLST+', '+CLTFST,DATEFROMPARTS(cltbyr,cltbmm,cltbdd),CLTCTY+', '+[ CLTSTA],CLTSSN,CLTSEX FROM CLTMST WHERE CLTLST = @NameLast+'%' AND (cltbyr+'-'+cltbmm+'-'+cltbdd = @DOB)";
                }
        }

        protected void SqlDataSource1_Selecting(object sender, SqlDataSourceSelectingEventArgs e)
        {

        }
    }
}

Answer 1

I think you would be better off doing this declaratively, with ControlParameters. In your markup, you would have a <SelectParameters> section to your SqlDataSource1 declaration:

<asp:SqlDataSource ID="SqlDataSource1" runate="server"
    CancelSelectOnNullParameter="False" ...other stuff... >
    ...other stuff...
    <SelectParameters>
        <asp:ControlParameter name="NameLast" controlid="SearchLast" propertyname="Text"/>
        <asp:ControlParameter name="NameFirst" controlid="SearchFirst" propertyname="Text"/>
        <asp:ControlParameter name="SSN" controlid="SearchSSN" propertyname="Text"/>
        <asp:ControlParameter name="DOB" controlid="SearchDOB" propertyname="Text"/>
        <asp:ControlParameter name="Case" controlid="SearchCase" propertyname="Text"/>
    </SelectParameters>
</asp:SqlDataSource>

This way you don't have to deal with adding them on Page_Load. Notice that I added the CancelSelectOnNullParameter property, and set it to false. That way your query will execute, even if some of the values are empty.

You could also combine all your queries into one, that way you don't need to have all those if statements in your click event:

SELECT 
    CLTCAS, 
    CLTLST+', '+CLTFST,
    DATEFROMPARTS(cltbyr,cltbmm,cltbdd), 
    CLTCTY+', '+[ CLTSTA],
    CLTSSN,
    CLTSEX 
FROM CLTMST 
WHERE 
    CLTCAS = @Case
    OR right(CLTSSN,4) = @SSN
    OR CLTSSN = @SSN
    OR (CLTLST = @NameLast AND CLTFST LIKE @NameFirst+'%')
    OR CLTLST LIKE @NameLast+'%'
    OR cltbyr+'-'+cltbmm+'-'+cltbdd = @DOB
    OR (CLTLST LIKE @NameLast+'%' AND (cltbyr+'-'+cltbmm+'-'+cltbdd = @DOB))

---

As far as your original code goes, when you add TextBox values as parameters, you want to add the .Text property as the default value:

SqlDataSource1.SelectParameters.Add("NameLast", SearchLast.Text);

Answer 2

You need something like this

In the class scope

private bool _hasWhere;

Method to dynamically build Select statement

private string GetSelectSql()
{

    string sql = "Select ...... From .... "; // also, make sql a StringBuilder

    if (txtLastName.Text.Trim() != string.empty)
    {
        if (SetWhere()) 
            sql += " Where ";
        else 
           sql += ",";  
        sql += string.Format(" LastName like '%{0}%' ", txtLastName);
    }

    if (txtFirstName.Text.Trim() != string.empty)
    {
        if (SetWhere()) 
           sql += " Where ";
        else 
           sql += ",";  
        sql += string.Format(" FirstName like '%{0}%' ", txtLastName);
    }
    // keep on going here .................

    return sql;
}

Helper method to identify if where was inserted already

// if your sql was StringBuilder you would just pass it here and do sb.Append(" Where ")
private bool SetWhere()
{
    if (!hasWhere) 
    {
       hasWhere = true;
       return true;
    }
    return false;
}

A method that gets you the command object

private SqlCommand CreateCommand (string sql)
{

    .............
    SqlCommand command = new Sqlcommand(sql,....
    .............
    return Command
 }

So then you can assign your command right before executing it

SqlDataSource1.SelectCommand = CreateCommand(GetSelectSql()) 

This is not fully functional code but I hope this will give you an idea what you need to do