Insert parameters into string

aspless · April 13th, 2012, 09:59 AM

I am looking to programically set a datasource using VB

What i am trying to prevent is SQL injection and so would like to find the most affective way of passing a parameter into a string.. eg

Instead of:

Code:

Dim SQLStr AsString
SQLStr="Select * from table where column = " + Parameter
SqlDataSource1.SelectCommand = SQLStr

I am using

Code:

Dim SQLStr AsString
Dim SQLStrRep AsString
SQLStr="Select * from table where column = @id"
SQLStrRep = Replace(SQLStr, "@Id", somevalue)
SqlDataSource1.SelectCommand = SQLStrRep

Is there a better way of adding parameters as this approach would soon get quite messy if muliple values needed to be added?

Cheers

Aspless ...