C#

public void Fetch()
{
    database.Query("SELECT * FROM ws_cart_product WHERE cart_id=?cart_id;");
    database.Add("?cart_id", cart_id);

    foreach (DataRow row in database.FetchAsDataTable().Rows)
    {
        cart_id = global.ParseInt(row["cart_id"].ToString());
        if (row["product_id"] != DBNull.Value)
        {
            product_id = global.ParseInt(row["product_id"].ToString());
        }
        if (row["parent_id"] != DBNull.Value)
        {
            parent_id = global.ParseInt(row["parent_id"].ToString());
        }
        if (row["quantity"] != DBNull.Value)
        {
            quantity = global.ParseInt(row["quantity"].ToString());
        }

// Here I try to combine them
        Product product = new Product();
        product.product_id = global.ParseInt(row["product_id"].ToString());
        product.Fetch();
    }
}

public void Fetch()
{
    StringBuilder query = new StringBuilder();
    query.Append("SELECT *,  ");
    query.Append("(");
    query.Append("SELECT thumbnail ");
    query.Append("FROM ws_product_file, file ");
    query.Append("WHERE file.file_id=ws_product_file.file_id ");
    query.Append("AND ws_product_file.product_id=ws_product.product_id ");
    query.Append("AND file.status_id=1 ");
    query.Append("ORDER BY sortorder DESC LIMIT 0,1");
    query.Append(") ");
    query.Append("AS thumbnail,  ");
    query.Append("(");
    query.Append("SELECT mimetype ");
    query.Append("FROM ws_product_file, file ");
    query.Append("WHERE file.file_id=ws_product_file.file_id ");
    query.Append("AND ws_product_file.product_id=ws_product.product_id ");
    query.Append("AND file.status_id=1 ");
    query.Append("ORDER BY sortorder DESC LIMIT 0,1");
    query.Append(") ");
    query.Append("AS mimetype ");
    query.Append("FROM webpage, ws_product ");
    query.Append("WHERE webpage.status_id=1  ");
    query.Append("AND webpage.webpage_type_id=4 ");
    query.Append("AND ws_product.product_id=webpage.webpage_type_content_id ");
    query.Append("AND ws_product.product_id=?product_id; ");
    database.Query(query.ToString());
    database.Add("?product_id", product_id);

    foreach (DataRow row in database.FetchAsDataTable().Rows)
    {
        product_id = global.ParseInt(row["product_id"].ToString());
        if (row["parent_id"] != DBNull.Value)
        {
            parent_id = global.ParseInt(row["parent_id"].ToString());
        }
        if (row["status_id"] != DBNull.Value)
        {
            status_id = global.ParseInt(row["status_id"].ToString());
        }
        if (row["create_date"] != DBNull.Value)
        {
            create_date = global.ParseDateTime(row["create_date"].ToString());
        }
        if (row["product_no"] != DBNull.Value)
        {
} 
// There is more...
}
}

{Dotcontent.CartProduct}

  cart_id: 1
  product_id: 64
  parent_id: 0
  quantity: 2
  customer_id: 0
  guid: null


{Dotcontent.Product}

  webpage_id: 145
  website_id: 0
  status_id: 1
  url: "mode360-composer-fotostudio-fa40"
  type: null
  webpage_type_id: 0
  webpage_type_content_id: 0
  version: 0
  language_id: 0
  parent_id: 0
  related_webpage_id: 0
  title: "Mode360 Composer Fotostudio FA40"
  text: null
  short_description: null
  meta_description: null
  published_from: 1-1-0001
  published_to: 1-1-0001
  created_on: 1-1-0001
  created_by: 0
  product_id: 64
  create_date: 16-9-2016
  product_no: "291610"
  ean: ""
  price_on_request: False
  weight: 0
  brand_id: 0
  in_export: False
  template_id: 1
  mimetype: "image/jpeg"
  thumbnail: "iVBORw0KGg
  price: 0
  old_price: 0
  label: "Tijdelijke aanbieding"
  quantity: 0

CartProduct cart = new CartProduct();
       cart.cart_id = 1;
       cart.Fetch();

       Response.Write("<pre>" + ObjectDumper.Dump(cart) + "</pre>");


       Product product  = new Product();
       product.product_id = cart.product_id;
       product.Fetch();

       Response.Write("<pre>" + ObjectDumper.Dump(product) + "</pre>");

I need to design class library for sql injection prevention by using ASP.NET with C# When the application server received input from the user, it dynamically generated the query based on the input. This query, along with the developer-intended query made use of keyword randomization, where the randomly generated key was appended to the SQL keywords in both queries. These queries were then forwarded to an XML parsing component, which converted both queries into XML trees. and comparing the corresponding nodes in these sub-stacks by using multiple threads, and based on the result of comparison, the algorithm was able to determine whether the dynamically built query was an attack or not. If this query was non-malicious, it was allowed to pass further to the database server for execution. However, if the algorithm determined a query as an attack, it was blocked at the application server and was not sent to the database server for execution. The attack queries were added to an error log to help the system administrators to My Email : [DELETED]@gmail.com