Click here to Skip to main content
15,884,962 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hi Guys, I have lengthy string. it is single line. i want to seperate string into different lines . it is in the below code.

SQL
string strquery = "INSERT INTO EMPLOYEE_REQUISITION_DETAILS2(REQNO,DIVISIONID,REQESITION_DT,LOCATION,EMPTYPE,JOBTYPE ,EDU_QULIFCATIONS,POSITION,NOOF_EMPLOYEES,EXPERIENCE_MIN,EXPERIENCE_MAX,PREF_JOINDT,SALARY_BUDGET,FILENAME,JOBDESC,RAISED_EMPID,RAISED_DT,PANEL_MEMBERS_TECH1,PANEL_MEMBERS_TECH2,Req_status) Values('" + txtRequisitionNumber.Text + "','" + ddlDivision.SelectedItem.Text + "','" + txtRequisitionDate.Text + "','" + ddlLocation.SelectedItem.Text + " ','" + rbnl.SelectedItem.Text + "','" + rbnlJobType.SelectedItem.Text + "','" + "MCA" + "' ,'" + ddlPosition.SelectedItem.Text + "','" + txtNoOfRequired.Text + "','" + ddlMin.SelectedItem.Text + "','" + ddlMax.SelectedItem.Text + "','" + txtJoiningDate.Text + "','" + txtSalaryBudget.Text + "','" + "dd" + "',' " + strJobDescription + " ','" + txtEmpId.Text + "','" + txtDate.Text + "','" + strTechnicaRound1 + "','" + strTechnicaRound2 + "','open')";



Please any one help .
Posted

u should use this link of codeproject-> how to print address in proper format? (C# WINDOWS)[^]
 
Share this answer
 
First, just add '+' where you think it a good idea:
C#
string strquery = "INSERT INTO EMPLOYEE_REQUISITION_DETAILS2" +
                  "(REQNO,DIVISIONID,REQESITION_DT,LOCATION,EMPTYPE,JOBTYPE,EDU_QULIFCATIONS," + 
                    "POSITION,NOOF_EMPLOYEES,EXPERIENCE_MIN,EXPERIENCE_MAX,PREF_JOINDT," +
                    "SALARY_BUDGET,FILENAME,JOBDESC,RAISED_EMPID,RAISED_DT,PANEL_MEMBERS_TECH1," +
                    "PANEL_MEMBERS_TECH2,Req_status) " +
                    "Values(...

Second, don't do it like that! Do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead. They also make your query a lot easier to read...
 
Share this answer
 
Comments
CH Guravaiah 6-Nov-12 6:36am    
thanks
you can try "+" Plus operator between two string line, like:

C#
string strquery = "INSERT INTO "+
                "EMPLOYEE_REQUISITION_DETAILS2"+
                "(REQNO,DIVISIONID,REQESITION_DT,LOCATION,EMPTYPE,JOBTYPE ,EDU_QULIFCATIONS,POSITION,NOOF_EMPLOYEES,"+
                "EXPERIENCE_MIN,EXPERIENCE_MAX,PREF_JOINDT,SALARY_BUDGET,FILENAME,JOBDESC,RAISED_EMPID,RAISED_DT,"+
                "PANEL_MEMBERS_TECH1,PANEL_MEMBERS_TECH2,Req_status) "+
                "Values('" + txtRequisitionNumber.Text + "','" + ddlDivision.SelectedItem.Text + "','" + txtRequisitionDate.Text + "',"+
                "'" + ddlLocation.SelectedItem.Text + " ','" + rbnl.SelectedItem.Text + "','" + rbnlJobType.SelectedItem.Text + "',"+
                "'" + "MCA" + "' ,'" + ddlPosition.SelectedItem.Text + "','" + txtNoOfRequired.Text + "','" + ddlMin.SelectedItem.Text + "',"+
                "'" + ddlMax.SelectedItem.Text + "','" + txtJoiningDate.Text + "','" + txtSalaryBudget.Text + "','" + "dd" + "',"+
                "' " + strJobDescription + " ','" + txtEmpId.Text + "','" + txtDate.Text + "','" + strTechnicaRound1 + "',"+
                "'" + strTechnicaRound2 + "','open')";
 
Share this answer
 
This isn't going to be the answer you wanted, but I think it's important enough to mention. You need to totally rethink how you're doing this. Your code is at extremely high risk of SQL Injection:

http://en.wikipedia.org/wiki/SQL_injection[^]

https://www.owasp.org/index.php/SQL_Injection[^]

Creating dynamic SQL by means of concatenating strings with unsanitized input values like this:

C#
'" + txtRequisitionNumber.Text + "'


is asking for big trouble. Assuming you're talking to a SQL Server backend, you could do a lot worse than rewriting this to use a parameterized SQLCommand:

http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlcommand.aspx[^]

http://www.csharp-station.com/Tutorial/AdoDotNet/lesson03[^]

http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlparameter%28v=vs.100%29.aspx[^]

You could also have a look at OleDbCommand or an ORM like Entity Framework or NHibernate.

If you rewrite this to use parameterized input values you're eliminating some of the risk associated with untrusted i.e. user input.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900