Database

string sql= [whatever the user passes in]

SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings[Utils.GetConnectionString].ToString());
        connection.Open();

        SqlCommand command = connection.CreateCommand();
        command.CommandType = CommandType.Text;
        command.CommandText = sql;


        try
        {
            int result = command.ExecuteNonQuery();

            if (result != 1)
            {
                Response.StatusCode = 500;
                Response.Write("The file has been uploaded, but we could not update the DB");
                Response.End();
            }
        }
        catch (InvalidOperationException)
        {
            Response.Clear();
            Response.Write("error");
            Response.StatusCode = 500;
            Response.End();
        }

        connection.Close();

declare @i  as Integer<br />
set @i=1;<br />
<br />
select tablename.ColName where Col.ID=@i

SELECT * FROM myTable <br />
WHERE<br />
(<br />
	SELECT COUNT(*) FROM myOtherTable<br />
	WHERE (myOTID = @param1 OR<br />
		  myOTID = @param2 OR<br />
		  myOTID = @param3 OR [could me more ORs]) AND (myOtherTable.myID= myTable.myID)<br />
) = 3