[RESOLVED] incorrect syntax near % sql parameter

[KGComputers]

Hi,

I have this sql statement which will be passed to sql server 2008. This works fine.

string query = "Select * from Patient where LastName like '" + family + "%'";

However, when i tried to use a parameterized query like this:

string query = "Select * from Patient where LastName like '" + "@family" + " %'";

it gives me an error.

I tried putting a blank space before the @ sign. but its not doing right.

Any ideas? Btw, @family is sqldbtype.varchar.

tnx

[GaryMazzone]

Remove the qoutes around the parameter

[techgnome]

Bravo for attempting to use parameters....

Just need a little tweaking...

string query = "Select * from Patient where LastName like (@family + '%')";

First problem was that you had your parameter inside of tick marks, making it a literal string... which isn't what you want... but the "%" does need to be a literal... and it just simply needs to be added to the parameter. Viola!

-tg

[KGComputers]

Hi tg and gary,

Bravo for attempting to use parameters....

Ur welcome, we had this practice to use sql parameters when talking to sql server to prevent injections.

string query = "Select * from Patient where LastName like (@family + '%')";

Works like a charm...thanks...I'll put this topic under my signature..

Greg