INNER JOIN with Where condition not working - sql

Question

I have a SQL query in C# ASP.NET MVC, it works well without WHERE condition, but with a WHERE condition, it doesn't work.
Here is SQL statement:
string strSQL = "SELECT u.USERID, u.NAME, io.CHECKTIME, io.CHECKTYPE, io.SENSORID
FROM USERINFO u
INNER JOIN CHECKINOUT io ON u.USERID = io.USERID
WHERE u.NAME = " + conditionSearch.NAME;
With conditionSearch.NAME is a variable from a view, I checked it, it's OK with a value need to search.
Could you please show me what is wrong in this WHERE condition? Thanks you!

Answer 1

The immediate fix here would be to put the name in the WHERE clause inside single quotes, to make a string literal:
string strSQL = "SELECT u.USERID, u.NAME, io.CHECKTIME, io.CHECKTYPE, io.SENSORID
FROM USERINFO u INNER JOIN CHECKINOUT io ON u.USERID = io.USERID
WHERE u.NAME = '" + conditionSearch.NAME + "'";
However, doing a direct concatenation to form a SQL query string is usually seriously bad practice. A much better approach would be to use a prepared statement, with a placeholder for the name. That is, use a query looking something like:
SELECT u.USERID, u.NAME, io.CHECKTIME, io.CHECKTYPE, io.SENSORID
FROM USERINFO u
INNER JOIN CHECKINOUT io
ON u.USERID = io.USERID
WHERE u.NAME = ?;
Then, let your database worry about how to bind the name parameter correctly.

Answer 2

The immediate fix here would be to put the name in the WHERE clause inside single quotes, to make a string literal:
Hi Tim, Thank for reply. I tried with a exact a name have in db with single quotes, but the result still return null.
oh, but I tried with your solution ('" + conditionSearch.NAME + "'") and it work perfectly.
Thanks you so much!