使用子查询asp.net插入查询

Question

I need to insert text from a asp.net web form. The final insert in my string needs to insert the the value from a column based on a treeview checked value. I need to run a sub query in my insert statement that avoids SQL injection. The current code inserts a null value rather than the value from the select statement.

This is my code:

string content = TxtContent.Text;
string Pagename = txtKeywords.Text;
string title = TxtPageName.Text;
string description = TxtDescription.Text;
string URL = TxtPageName.Text;
string Keywords = txtKeywords.Text;
string tree = TreeView1.SelectedValue;

string query = @"INSERT INTO Menus([content], [Pagename], [title], [description], [Keywords], [url], [ParentMenuId]) " + "Values('" + content + "', '" + Pagename + "', '" + title + "', '" + description + "', '" + Keywords + "', '/" + URL + "', (Select [parentmenuid] from [menus] where [title] ='"+tree+"'))";

using (SqlConnection connection = new SqlConnection("Data Source=MYConnectionString"))
{
    using (SqlCommand command = new SqlCommand(query, connection))
    {
        connection.Open();
        command.ExecuteNonQuery();
    }
}

Answer 1

According to MSDN, you can user dynamic queries similar to the following ( http://ud.ht/bDhf Check Step 3 )

First create an object of the "SqlDataAdaptor" class. Then for each variable, assign an arbitrary name and add it to the command.

using System.Data;
using System.Data.SqlClient;

using (SqlConnection connection = new SqlConnection(connectionString))
{
  DataSet userDataset = new DataSet();
  SqlDataAdapter myDataAdapter = new SqlDataAdapter(
         "SELECT au_lname, au_fname FROM Authors WHERE au_id = @au_id", 
         connection);                
  myDataAdapter.SelectCommand.Parameters.Add("@au_id", SqlDbType.VarChar, 11);
  myDataAdapter.SelectCommand.Parameters["@au_id"].Value = SSN.Text;
  myDataAdapter.Fill(userDataset);
}