searching more than 1 array index values from database in one query

Question

i am doing a search from database. user will enter string. this string will be converted into array then this array indexed values will be checked from table to find the match. I am using loop to traverse array query execution is in that loop, it searches fine but if there was more than one index to search it shows the last index searched values. i know know that's not a proper way to search.

how can i do this.

SqlConnection conOpen;
string[] arrayList;
protected void Page_Load(object sender, EventArgs e)
{
    DataLayer datalayer = new DataLayer();
    conOpen = datalayer.connectionOpen();

    string myString = Request.QueryString["searchText"].ToString();
    char[] separator = new char[] { ' ' };
    arrayList = myString.Split(separator);
    for (int i = 0; i <= arrayList.GetUpperBound(0); i++)
    {
        Response.Write(arrayList[i]);

        string asd = arrayList[i];


        String arrayQuery = "Select * from tbl_products where product_name LIKE '%" + @asd + "%'";

        DataSet ds = new DataSet();
        SqlDataAdapter da = new SqlDataAdapter(arrayQuery, conOpen);
        da.Fill(ds, "tbl_products");
        GridView1.DataSource = ds;
        GridView1.DataBind();
    }
}

Answer 1

I'm too clear on what your final result is supposed to be but I'm going to guess. I think what you are asking is that you want the query to search for every instance of the search items (seperated by a space) the users put in the input element and return ALL of these findings to your GridView. Ok. So I would suggest you loop to "build" your sql statement and then run the sql and bind the data AFTER the loop (not during).

One more important element is that you should most definitely parametrize these values since it's coming from user input in order to prevent SQL-Injection. Please forgive any typos (it is late).

        DataLayer datalayer = new DataLayer();
        conOpen = datalayer.connectionOpen();

        string myString = Request.QueryString["searchText"].ToString();
        char[] separator = new char[] { ' ' };
        arrayList = myString.Split(separator);
        StringBuilder arrayQuery = new StringBuilder();
        SqlCommand myCommand = new SqlCommand();

        for (int i = 0; i < arrayList.Length; i++)
        {
            if (i==0)
            {
                arrayQuery.Append("Select * from tbl_products where product_name LIKE @asd" + i);
            } else{
                arrayQuery.Append(" OR product_name LIKE @asd" + i );
            }

            myCommand.Parameters.AddWithValue("@asd" + i, "%" + arrayList[i] + "%");
        }

        myCommand.CommandText = arrayQuery.ToString();
        myCommand.Connection = conOpen;
        DataSet ds = new DataSet();
        SqlDataAdapter da = new SqlDataAdapter(myCommand);
        da.Fill(ds, "tbl_products");
        GridView1.DataSource = ds;
        GridView1.DataBind();