Session Query?

[acrow]

Using VS2010, NET 3.5 - VB

Is this the proper way to do a query from a session?

"SELECT * FROM Members WHERE " + Session("Email") + "= Email"

Thanks!

[jmcilhinney]

So, this is an ASP.NET application and you have the an email address in a session variable, correct? You then want to get all the information for the member with that email address, correct? If so then it should be like this:

myCommand.CommandText = "SELECT * FROM Members WHERE Email = @Email"
myCommand.Parameters.AddWithValue("@Email", Session("Email"))

For more information on using parameters, follow the last link in my signature.

[plender]

"SELECT * FROM Members WHERE " + Session("Email") + "= Email"

That is asking for a SQL Injection Attack

[sapator]

Hi.
I don't suppose you mean, Membership.GetUser().Email.ToString ?