Hi Gary,

Use a stored procedure that you can call from a COM object passing the
value of the "Login Name" to the stored procedure.
An Alternative is, of course, to build the whole Select statement in C#
and then pass that to the SQL server.

Example (In VB) using a stored procedure

Dim Username as String, Password as String
Username = Request("Username")
Password = Request("Password")

Dim LoggedIn as Boolean = False

---------------------
If (Len(Username) > 0) and (Len(Password) > 0) then
	Dim myConnection as New
SQLConnection(ConfigurationSettings.AppSettings("DSN"))
	Dim myCommand as New
SQLCommand("STOREDPROCEDURE_NAME",myConnection)
	myCommand.CommandType = CommandType.StoredProcedure

	Dim paramUsername as New
SQLParameter("@Username",SQLDBType.varchar,100)
	paramUsername.Value = Username
	myCommand.parameters.add(paramUsername)

	Dim paramPassword as New
SQLParameter("@Password",SQLDBType.varchar,100)
	paramPassword.Value = Password
	myCommand.parameters.add(paramPassword)

	Dim paramLoginOk as New SQLparameter("@LoginOk",SQLDBType.Bit)
	paramLoginOk.Direction = ParameterDirection.Output
	myCommand.parameters.add(paramLoginOk)

	Try
		myConnection.Open()
		myCommand.ExecuteNonQuery()
		LoggedIn = Cbook(paramLoginOk.Value)
	Catch e as exception
		Throw e
	Finally
		if myConnection.State = ConnectionState.Open
			myConnection.Close()
		end if
	End Try

	If LoggedIn = True then
		' Code to welcome the user
	Else
		' Code to tell the user to get lost :)
	End if
Else
	' Code to tell the user he/she needs to enter username/password
End if
----------------------------

Example in VB Using Select Statement

Dim Username as String, Password as String
Username = Request("Username")
Password = Request("Password")

Dim LoggedIn as Boolean = False

-- Same declarations as before.

	Dim SQLString as String
	SQLString = "SELECT * FROM USERS WHERE USERNAME=" & Username & "
AND PASSWORD=" & Password
	Dim myCommand as New SQLCommand(SQLString,myConnection)

Hope this helps.

Amir Meskovic
meskovic@e...

-----Original Message-----
From: Gary Liptak [mailto:gary_liptak@y...]
Sent: Monday, December 17, 2001 7:36 AM
To: sql language
Subject: [sql_language] SELECT on SQLServer using C#


In the books on C# it only shows Select statements with "hard" coded
where
clauses.
How about a REAL LIFE EXAMPLE...
I want to "SELECT OPERATROR_ID FROM TABLE WHERE OPERATOR_ID = "entered
value". The entered value is a string field that was entered on a logon
dialog box. NOT A HARD CODED VALUE in the program. HOW REAL IS THAT. NO
POINT IN SQL if you have to HARD CODE all the valid entered DATA!!!

Any suggestions!!!

gary


$subst('Email.Unsub').