C# Dynamic SQL query

Question

SqlCommand s2 = new SqlCommand();
s2.CommandText = @"declare @sql nvarchar(max);

set @sql = 'select sys_RespNum from ' + quotename(@tableName) + 'where' + 'respid' + 'in' + '(' + @emails + ')';
exec (@sql);

What's wrong with the code? I get an error:

Incorrect syntax near @emails

Note that you should not build SQL commands with string concatenation, it is extremely dangerous because it's so easy to hack. Instead you should use the overload of the Query method you're using to supply the parameters separately. — NibblyPig
– NibblyPig, Commented Mar 4, 2019 at 16:28

Zaynul Abadin Tuhin · Accepted Answer · 2019-03-04 16:35:48Z

3

you missed space

set @sql = 'select sys_RespNum from ' + quotename(@tableName) + ' where ' + ' respid ' + ' in ' + '( ' + @emails + ' )';
exec (@sql);

edited Mar 4, 2019 at 16:35

answered Mar 4, 2019 at 16:26

Zaynul Abadin Tuhin

32.1k6 gold badges38 silver badges67 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Luke Mark Lorenzo Badeo Over a year ago

Incorrect syntax near '[email protected]'. Still error

Zaynul Abadin Tuhin Over a year ago

@LukeMarkLorenzoBadeo check now there will be another space after parenthesis

juharr Over a year ago

That could just be ... + ' where respid in (' + ... instead. That way it's easier to see the need for the spaces.

Collectives™ on Stack Overflow

C# Dynamic SQL query

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related