|
Hi,
OK I suggest you check your database responds to SQL parameters, either parameters by name as in WHERE email=@email or by sequence as in WHERE email=?. So check the documentation on SQL parameters.
If it does not, you could go for "_" instead of "%" since the former should match exactly one character, which is bound to be a "@" in an e-mail address.
However, parameterized queries are the better option, since they protect you against SQL injection attacks, and don't force you to escape special characters such as " ' " and " _ ".
Luc Pattyn [Forum Guidelines] [My Articles]
- before you ask a question here, search CodeProject, then Google
- the quality and detail of your question reflects on the effectiveness of the help you are likely to get
- use the code block button (PRE tags) to preserve formatting when showing multi-line code snippets
|
|
|
|
|
Unfortunately I cannot use parameters. The whole point of the program that I'm working on is that it lets users type an sql statement to create their own queries to the data. (Program is only used by fellow developers) So I guess I will have to use your suggestion and replace any @ symbols with _ or just let my users know that they need to do that themselves when typing the SQL statement and querying by email address.
Thanks for your input.
|
|
|
|
|
Okay....so this question was a total wash. I just found some code in the program that will replace an @ symbol with an empty string because it was causing a different problem. So....this was the reason it wasn't behaving the way I wanted and yeah. Sorry to waste your time.
|
|
|
|
|
Kschuler wrote: I just found some code in the program that will replace an @ symbol with an empty string
I trust that was while investigating why "_" did not work for you... 
Luc Pattyn [Forum Guidelines] [My Articles]
- before you ask a question here, search CodeProject, then Google
- the quality and detail of your question reflects on the effectiveness of the help you are likely to get
- use the code block button (PRE tags) to preserve formatting when showing multi-line code snippets
|
|
|
|
|
i have this stored procedure in database.
<br />
ALTER PROCEDURE dbo.SearchForASpecificDocumentByFromBeginsWith<br />
(<br />
@SenderName nvarchar(50)<br />
)<br />
<br />
AS<br />
<br />
Select * from MyTable<br />
<br />
Where (SenderName like 'SenderName%')<br />
<br />
RETURN<br />
how can i use the argument (with the like operator) i am passing into this?
|
|
|
|
|
i have found the solution. here it is.
<br />
ALTER PROCEDURE dbo.SearchForASpecificDocumentByFromBeginsWith<br />
(<br />
@SenderName nvarchar(50)<br />
)<br />
<br />
AS<br />
<br />
Select * from MyTable<br />
<br />
Where (SenderName LIKE + @SenderName + '%')<br />
<br />
RETURN<br />
|
|
|
|
|
That can't work. You have too many + operators. The + between LIKE and @SenderName should be removed.
|
|
|
|
|
if you need too many operators you must use dynamic variable
for example:
-- this stored procedure used to search
create PROCEDURE [dbo].[SP__Find_Country]
(
@chv_Country_name varchar(150)=null,
@Calling_no varchar(5)=null,
@Short_Name varchar(3)=null
)
AS
set nocount on
Declare @Condition varchar(8000)
Set @condition =''
IF @chv_Country_name is not null
set @Condition=' co_name like ''' +@chv_Country_name + '%'''
IF @Calling_no is Not Null and @Condition =''
set @Condition=' co_Calling_code like ''' +@Calling_no + '%'''
else If @Calling_no is not Null
set @Condition=@Condition +' and co_Calling_code like ''' +@Calling_no + '%'''
IF @Short_Name is not null and @Condition =''
Set @Condition=' co_Short_Name like ''' +@Short_Name + '%'''
else IF @Short_Name is not null
Set @Condition=@Condition+' and co_Short_Name like ''' +@Short_Name + '%'''
if @Condition <> ''
Set @Condition=@Condition+' and co_deleted=0'
print @condition
if @condition =''
select * from Country
where co_deleted=0 -- Updated by Nabeel Adnan
Order By Country.co_name -- Updated By Mahmoud Khalil
else
begin
Exec ('select * from Country where '+ @condition + ' Order By co_name ')
print 'select * from Country where '+ @condition + ' Order By co_name '
end
|
|
|
|
|
Rami Said Abd Alhalim wrote: if you need too many operators you must use dynamic variable
If I need too many operators. Why would I need too many? Why don't I just need the right number?
Rami Said Abd Alhalim wrote: create PROCEDURE [dbo].[SP__Find_Country]
+10 Points for using stored procedures.
Rami Said Abd Alhalim wrote: set @Condition=' co_name like ''' +@chv_Country_name + '%'''
And take twice as many away for writing code that is vulnerable to a SQL Injection attack.
You should really look into sp_executesql and see how to pass parameters into dynamically built SQL.
|
|
|
|
|
I am trying to do a search on all the data in a specific table.
How do I search across all columns? And how do I search period? The LIKE command isn't working how I'd like it to, or I am not using it right.
EXAMPLE:
Player Name:
John Doe
Johnny Hopkins
Night Hawk
I would like to be able to search 'john' and get the first two records return, or 'doe' for the first, or 't h' and get the third ect.
The LIKE command seems to be too picky although I may be wrong...
Thanks for your time.
The best way to accelerate a Macintosh is at 9.8m/sec² - Marcus Dolengo
modified on Saturday, March 7, 2009 10:51 AM
|
|
|
|
|
That sounds an awfull lot like a Full Text Search. Someone made an example here[^] 
I are troll
|
|
|
|
|
What does your SQL statement look like? It should look something like this:
SELECT PlayerName FROM Table WHERE UPPER(FirstName) LIKE '%JOHN%' OR UPPER(LastName) LIKE '%JOHN%'
But if you really have to search ALL columns you will have to add a LIKE for each column name in the WHERE portion of you statement.
Hope this helps.
|
|
|
|
|
Hello guys, i think i have a stupid question but worth a try. I have an application where it is uploading a file to a remote server via a webservice, after doing this it will unzip the data and merge that data with the database in the remote server. Now I was thinking what if 2 people where uploading at the same time and try to merge the data at the same time wouldnt that resort in some kind of error. Doest SQL server handle this problem its self or is there somehow i can handle it trough c# code?
Thank you for your time in advance and sorry if it's a stupid question.
|
|
|
|
|
What do you mean 'merge' the data?
The best way to accelerate a Macintosh is at 9.8m/sec² - Marcus Dolengo
|
|
|
|
|
It depends on what you mean by merge. But at a most basic level SQL Server is designed to be used by multiple users simultaneously.
I suppose if the uploaded data is meant to be uploaded in a specific sequence and the second set of data starts being "merged" before the first then you have a problem. If the data doesn't have that sort of constrant then I don't see there being a problem.
Will the two sets of data being uploaded overlap in anyway? e.g. they both cause the same row to be updated. If that is the case who wins? In other words which update gets retained, and which is overwritten or thrown away? If there is no over lap then there is no problem.
If the two sets of data pertain to only new information that is being added to the database then I don't see any real problem at all.
But, it really all depends on what you mean by "merge"
|
|
|
|
|
In SQL Server 08, the 'Execute SQL' ability is grayed out in the Query designer.
I don't see how it could be permisions because if I right click on the table and choose 'Edit top 1000 rows' I get the thousand rows.
Thanks
|
|
|
|
|
I'm not being silly, but does the query window have the current focus? The only time it greys out for me is when the Query window loses focus.
|
|
|
|
|
Yep it has focus. I open the query designer, add a table to it and right click in the designer.
The Execute SQL option is grayed out.
Is this how you operated it?
Thanks
|
|
|
|
|
enipla wrote: query designer
Actually, I just discovered there is a thing called a Query Designer. I normally just write queries. I never knew about this crazy thing.
It is greyed out for me too.
Have you considered just writing the query SQL yourself? That isn't greyed out.
|
|
|
|
|
Yeah, I can write the query myself, but the designer is VERY helpful, and that's how I'm used to doing it.
It worked in previous versions.
This is nuts. MS help hasn't been able to find anything.
|
|
|
|
|
Hi All,
iam using if else for updating and inserting, i need to do this for 3 tables how can i unite them using unions or join..
IF EXISTS (SELECT col1,col2,col3,col4
FROM TableB)
UPDATE TableB
SET col2=TableA.col2,
col3=TableA.col3,
col4=TableA.col4
from TableA
where (TableB.col1 = TableA.col1
and TableA.Col5='no')
ELSE
INSERT INTO TableB (col1,col2,col3,col4)
select TableA.col1,TableA.col2,TableA.col3,TableA.col4
from TableA
where TableA.Col5='no';
and i need to repeat this code for TableC and TableD (along with TableA) for updating TableB. How can i unite all in one procedure.Hope iam clear if not i can...Please help...
may be the solution is simple but i dont know...
i tried but unable to ...
i cannot use 3 sp's, i need all in one procedure
Thanks in advance
|
|
|
|
|
I don't fully see what you are trying to do. But if "unite all in one procedure" you mean that it all happens as one operation then you might want to look at transactions. If you wrap all of this up in a transaction it will appear as one procedure. Nothing else accessing the database will be able to see a half updated set of data. They'll either see the data as it was before the transaction, or they'll be locked out until the transaction is complete and when the lock is released they'll see it as the complete result.
|
|
|
|
|
i have these data in the database table, Meetings
MeetingID Details Hour Minute
1 Meeting Details1 14 10
2 Meeting Details2 14 15
how can i select all the fields of MeetingID 2?
<br />
SELECT MeetingID, Hour, Minute, Details<br />
FROM Meetings<br />
WHERE (Hour =<br />
(SELECT MAX(Hour) <br />
FROM Meetings)) AND (Minute =<br />
(SELECT MAX(Minute) <br />
FROM Meetings))<br />
but this code doesn't fetch any record
|
|
|
|
|
Of course it doesn't - the row with the max hour might not be the same row as the row with the max minute.
If you stored the meeting time in a single field (of type datetime or smalldatetime) which would be the right solution, this would be easy.
SELECT TOP 1 * FROM Meeting ORDER BY MeetingDateTime DESC
As it is with your table you can just do
SELECT TOP 1 * FROM MEeting Order BY Hour DESC, Minute DESC
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
