wrote:
> I'm building a dynamic command like this.
> "SELECT * FROM Clients WHERE FirstName LIKE @FirstName"
> and I set the paramater like this.
>
> sqlCMD.Paramaters.Add("@FirstName", "%" & fnameVariable & "%")
>
> The reason I'm doing this is I need it to search the whole field to
> see if it contains any of the text in "fnameVariable". My question is
> am I going to run into any problems if the user enters in any special
> characters for the "fnameVariable" (i.e. %, *, etc)?
> I was under the impression that using the SqlCommand with paramaters
> was supposed to take care of that sort of stuff.

> I'm building a dynamic command like this.
> "SELECT * FROM Clients WHERE FirstName LIKE @FirstName"
> and I set the paramater like this.
>
> sqlCMD.Paramaters.Add("@FirstName", "%" & fnameVariable & "%")
>
> The reason I'm doing this is I need it to search the whole field to see if

> I was under the impression that using the SqlCommand with paramaters was

"SubstandardSnowman" wrote:

> I'm building a dynamic command like this.
> "SELECT * FROM Clients WHERE FirstName LIKE @FirstName"
> and I set the paramater like this.
>
> sqlCMD.Paramaters.Add("@FirstName", "%" & fnameVariable & "%")
>
> The reason I'm doing this is I need it to search the whole field to see if it contains any of the text in "fnameVariable". My question is am I going to run into any problems if the user enters in any special characters for the "fnameVariable" (i.e. %, *, etc)?