SQL select statement confusion

Question

I am trying to create a select statement that checks with two values but checks one with null, i created this so far,

string selectStatement 
    = string.Format(@"SELECT a, b, c 
                      FROM Table1 
                      WHERE c IS NOT NULL AND a = {0} AND b = {1}",
                    aValue, bValue);

But I am pretty sure it will not work as we can't have 2 ands in select statement, any idea;s please ?

You can have as many And as you need :)..and it looks fine to me — Zaki, Jul 09 '13 at 15:43
Note that your SQL is vulnerable to SQL Injection attacks. See **[this article](http://stackoverflow.com/questions/6547986/how-to-prevent-a-sql-injection-escaping-strings)** for help on how to prevent this. — Michael Bray, Jul 09 '13 at 15:44
@user13814: It is still bad programming practice to use `string.Format` to create SQL queries. I strongly suggest you learn *and use* parameterized queries. — Michael Bray, Jul 09 '13 at 15:53
ahh, i know that but i forgot to use them, I will use them now, thanks :) — Mathematics, Jul 09 '13 at 15:55

score 2 · Accepted Answer · edited Jul 09 '13 at 15:51

2

You can have as many ANDs in your WHERE clause as you like.

If a and b are string values then you need quotes around the values - though it'd be much better to use a parameterized query and avoid the Sql Injection vulnerability

SELECT a, b, c 
FROM Table1 
WHERE c IS NOT NULL 
AND a = @p0
AND b = @p1

edited Jul 09 '13 at 15:51

Mark Brackett

84,552
17
108
152

answered Jul 09 '13 at 15:44

juergen d

201,996
37
293
362

3

...unless OP uses parameterized queries to prevent SQL injection – Michael Bray Jul 09 '13 at 15:46
@MichaelBray: How do you know? – juergen d Jul 09 '13 at 15:47
because parameters don't require type delimiters... you can say `WHERE Email=@email` without quotes, pass a string to `@email` and it works fine – Michael Bray Jul 09 '13 at 15:50
...and now Mark just made my comment irrelevant. haha :) – Michael Bray Jul 09 '13 at 15:51

score 1 · Answer 2 · answered Jul 09 '13 at 15:46

1

There is no reason for that not to work, what DB are you using?

If in doubt you can also add parenthasis:

(c IS NOT NULL) AND ((a = value) AND (b = value))

answered Jul 09 '13 at 15:46

s1cart3r

334
1
4
9

SQL select statement confusion

2 Answers2