Select query from multiple textboxes c#

Question

I am still fairly new to both c# and SQL so please keep that in mind. I searched the site but couldn't find an answer.

I am building a basic ASP web form in C# that connect to a mysql database and populates a gridview with the results.

I have two text boxes on the web page: Phone number and User ID. I then have a button which when clicked runs the following code:

        protected void btnSubmit_Click(object sender, EventArgs e)
        {    
            {
                try
                {
                    conn.Open();
                    //SQL 
                    MySqlCommand cmd = new MySqlCommand("Select * from message where phone_number like @PatientMob and user_ID like @UserID, conn);
                    //Paramaters
                    cmd.Parameters.Add(new MySqlParameter(@"PatientMob", MySqlDbType.VarChar)).Value = PatientMobile.Text;
                    cmd.Parameters.Add(new MySqlParameter(@"UserID", MySqlDbType.VarChar)).Value = UserID.Text;

                    MySqlDataAdapter adp = new MySqlDataAdapter(cmd);
                    DataSet ds = new DataSet();
                    adp.Fill(ds);
                    gridview.DataSource = ds;

..etc

My question is, how do I format the query so that it works even if only one textbox is filled in? At the moment, if I enter a phone number but do not enter the user ID, the results are showing people with that phone number who have nothing entered into the user ID field.

I will be adding more text boxes later for title, first name, surname..etc and need a solution that will work with any combination of fields filled in or not filled in.

Thanks.

Answer 1

I will format the sql where string by myself. such as the code

if (!string.IsNullOrEmpty(Phone.Text))
        {
            whereCriteria += " phone like @Phone";
            cmd.Parameters.Add(new MySqlParameter(@"phone", MySqlDbType.VarChar)).Value = Phone.Text;
        }

Answer 2

I don't know of any great way to do this, unfortunately, but you do have a few options.

1. Build the string dynamically

Something like this:

List<string> wheres = new List<string>();
List<MySqlParameter> parameters = new List<MySqlParameter>();

if (!string.IsNullOrWhiteSpace(PatientMobile.Text))
{
    wheres.Add("phone_number LIKE @PatientMob");
    parameters.Add(new MySqlParameter(@"PatientMob", MySqlDbType.VarChar)
                   {
                       Value = PatientMobile.Text
                   });
}

...

string query = string.Format("SELECT * FROM Messages WHERE {0}", string.Join(" AND ", wheres));

And so on and so forth...

2. Check dynamically what's empty in the query

Something like this:

string query = "SELECT * FROM message WHERE (LEN(@PatientMob) = 0 OR phone_number LIKE @PatientMob) and (LEN(@UserID) = 0 OR user_ID LIKE @UserID)", conn);

3. I see you're using LIKE , and admittedly I'm not one for MySQL so this could be way off, but it seems like you could be wrapping your parameters with whatever character designates a wildcard match. In T-SQL, that would look something like column LIKE '%' + @param + '%' . Of course, that won't be an exact match, but that sounds like it might be what you're looking for. In cases of empty search boxes, that will just result in column LIKE '%%' , which would match any values.