Session Query?

Using VS2010, NET 3.5 - VB

Is this the proper way to do a query from a session?

"SELECT * FROM Members WHERE " + Session("Email") + "= Email"

Thanks!

So, this is an ASP.NET application and you have the an email address in a session variable, correct? You then want to get all the information for the member with that email address, correct? If so then it should be like this:

vb.net Code:

myCommand.CommandText = "SELECT * FROM Members WHERE Email = @Email"
myCommand.Parameters.AddWithValue("@Email", Session("Email"))

For more information on using parameters, follow the last link in my signature.

Quote:

---

Originally Posted by acrow

"SELECT * FROM Members WHERE " + Session("Email") + "= Email"

---

That is asking for a SQL Injection Attack :)

Hi.
I don't suppose you mean, Membership.GetUser().Email.ToString ?