String and ? : operators

Question

I have to build query string from string values like:

connString += "INSERT INTO (...) VALUES ( "+

_cd.userName "," +

//and there i'd like to use ?: operators:

_cd.lastLogin == "Null" ? "null" : _cd.lastLogin ","

So my query would look like INSERT INTO (...) VALUES ('name', null, (...))

But when Im using that it cuts my string, so it's look like

",null,1,2,'name', (...)";

Well, I know that I can use var a,b,c,d and then check if (_cd.lastLogin == "Null) a = null and put that into string, but there is many variables.

What is proper way to use it?

@EDIT: Code:

string query =  "INSERT INTO PersonLogin(...) " + Environment.NewLine +
 "VALUES (" + _cD.userID + ","
 + "'" + _cD.number + "',"
 + "'" + _cD.dateCreate + "','"
 + _cD.lastLogin == "Null" ? ",null," : _cD.lastLogin + "',"
 + _cD.taken + ","
 + _cD.canLogin + ""+ Environment.NewLine;

The proper way is to use SqlParameters. Building your queries like this is madness. — Arran
– Arran, Commented Oct 1, 2013 at 9:32
What Arran said. But to answer your question, probably put parentheses around all usages of ? :. — Jon
– Jon, Commented Oct 1, 2013 at 9:33
Ok, but textCommand will give me queries like INSERT INTO (...) VALUES (@par1, @par2) right? I need to create string with queries (from 10+ tables) and then send and execute that string as script in database in another server. — user13657
– user13657, Commented Oct 1, 2013 at 9:33
@user13657 The SQL client might be able to to a batch of operations like that. Even if not I'd just send the commands separately in the same transaction. — millimoose
– millimoose, Commented Oct 1, 2013 at 9:46

msm2020 · Accepted Answer · 2013-10-01 09:43:02Z

2

you can use SqlParameter and set value with DbNull.Value

INSERT INTO (...) VALUES (@par1, @par2) command.Parameters.AddwithValue("@par1",DbNull.Value)

answered Oct 1, 2013 at 9:43

msm2020

1811 silver badge11 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user13657 Over a year ago

I know that I can use SqlParameters and Command. But as I said i have tables with 50+ colums and for example only 20/50 are null. So with this solution i will need to do something like if(value == null) then add nullValue else add value.value

msm2020 Over a year ago

you can loop in command.parameters but this a bad solution OR + _cD.lastLogin == null ? ",null," : _cD.lastLogin + "',"

Peter · Accepted Answer · 2013-10-01 09:45:13Z

1

The proper way to make your queries is not building your queries with string, but using SqlParameters. This will give your more readable code and is better protected against sql injection.

answered Oct 1, 2013 at 9:45

Peter

28k8 gold badges69 silver badges85 bronze badges

Comments

msm2020 · Accepted Answer · 2013-10-01 09:47:00Z

0

? operator has lower precedence then + operator. So you need to parenthesize around the usage of ? and :.

connString += ... + (_cd.lastLogin == "Null" ? "null" :"'"+ _cd.lastLogin) +"'" ...;

edited Oct 1, 2013 at 9:47

msm2020

1811 silver badge11 bronze badges

answered Oct 1, 2013 at 9:41

Rafi Kamal

4,6309 gold badges38 silver badges52 bronze badges

3 Comments

user240141 Over a year ago

-1 for suggesting the wrong way of implementation. See msm2020 answer.

Rafi Kamal Over a year ago

@AmitRanjan I'm not suggesting this, I'm trying to show OP his mistake.

user13657 Over a year ago

I'll mark as solution, becaouse that's answer for my question, but well, as You all said - i'll try to do it with SqlCommand.

Collectives™ on Stack Overflow

String and ? : operators

3 Answers 3

2 Comments

Comments

3 Comments

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

3 Comments

Related