Is there a method to convert SqlCommand text

  • Thread starter Thread starter James Shen
  • Start date Start date
J

James Shen

In the SqlCommand, there is CommandText which has the parameterized
SQL. And the SqlParamterCollection which contains parameters.

Do anyone know how to convert this to a no parametric SQL string which
can be executed with isql ( not writting my own code. ).

Thanks
James
 
If I understand you correctly...

You can change the commandtext whereever you see fit. The parameters will
still be there, which will cause a problem, but you can simply use the
..Clear method of the paramters collection.

However, you don't have to use Parameters although they are certainly
preferable to dynamic SQL (trust me on this) for many reasons (like having
an apostrophe in the name, avoiding Injection Attack issues, performance
etc). You could just roll your own SELECT statement.

You may Bill Vaughn's article on Weaning developers from the commandbuilder
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnadonet/html/commandbuilder.asp
helpful

If you don't mind me asking, how is the SQL constructed in the first place?
Are you using a DataAdapter Configuration wizard, commandbuilder? I'm
guessing it's one of these otherwise you wouldn't need to edit the
commandtext and parameters.

HTH,

Bill
 
...Parameters ... are certainly preferable to dynamic
SQL (trust me on this) for many reasons (like having
an apostrophe in the name...
Click to expand...

I normally create my own SELECT statements and pass them via one of the
"execute" statements (never accessible at the command line), but I'm
curious about these Parameters. In particular, how would they help me
avoid running my SqlSafe() function on all my data that might have an
apostrophe in it?

-- Rick
 
Back
Top