Help with ASP.NET/SQL and MS Access

[McBainUK]

I have a MS access query that displays a popup box allowing you to enter a value for one of the columns to be searched for (using [WeekNumber] syntax).

How would I supply this programmitacally using ASP.NET/SQL? Or is there a better way of supplying params to lower level queries.

If any of you could help me with this it would be very much appreciated. I can upload the database file somewhere if you think it would be needed.

Thanks

[taz]

Are you looking for something like this?

sql = "ID > 0 AND WeekNumber Like ""*" & [WeekNumber] & "*"""

Taz

[McBainUK]

Will give that a try. Thanks

[Ommina]

Via ASP.NET, I'd suggest the preferred way is via a "parameterized query" rather than just building the value into the SQL string.

Building the SQL string manually will work, but can be slower (depending on the actual database), and, more importantly, opens you up to SQL-injection attacks -- which may or may not be a concern.

Still, since it's ASP, which sort of implies "random person from somewhere entering stuff", I would be quite nervous about SQL injection.