ASP.NET

public int GetAccountSortByAccountCode(int account)
{
    using (var connection = new SqlConnection("YOUR CONNECTION STRING"))
    using (var command = new SqlCommand("SELECT ac_sort_order FROM lkup_account_codes where ac_code = @account", connection))
    {
        command.Parameters.AddWithValue("@account", account);

        connection.Open();
        return Convert.ToInt32(command.ExecuteScalar());
    }
}

public int GetAccountSortByAccountCode(int account)
        {
            QueryContainer Instance = new QueryContainer("SELECT ac_sort_order FROM lkup_account_codes where ac_code = " + account.ToString());

            return Convert.ToInt32(ExecuteScaler(Instance.Query));
        }  <pre>

And here is my new class:

<pre>
public class QueryContainer
    {
        string _query;

        public QueryContainer(string query) { _query = query; }

        public string Query
        {
            get
            {
                return _query;
            }

            set { _query = value;  }
        }
    }
<pre>

So what do you think. Does someone that I will still get SQL injection errors?

holdorf wrote:

QueryContainer Instance = new QueryContainer("SELECT ac_sort_order FROM lkup_account_codes where ac_code = " + account.ToString());

holdorf wrote:

My boss is upset and is giving me only a few days to fix this.

holdorf wrote:

Remember I have only one function to fix and handle this problem.

holdorf wrote:

Can someone please give me a small piece of code of how this should be implemented?