Conditional statement in sql query on classic ASP Page - sql

Question

I am fetching three values in my page named 123.asp
(123.asp?School=NewEnglishSchool&Batch=1&AcademicYear=2)
School = Request.QueryString("School")
Batch = Request.QueryString("Batch")
AcademicYear = Request.QueryString("AcademicYear")
I have a simple query in form like below
strSqlData="select * from MyTable where gender="male""
I need to create a query like below, if I found a value for Batch and AcademicYear except for School on the page via Request.QueryString means (123.asp?Batch=1&AcademicYear=2)
then I want to write a query something like this
strSqlData="select * from MyTable where gender="male"
if len(AcademicYear)<>o then
and AcademicYear='"&AcademicYear&"'
elseif len(Batch)<>o then
and Batch='"&Batch&"'
end if
elseif len(School)<>o then
and School='"&School&"'
end if "
I want to create something like above but in proper method without using case, because I have so many filters on the page like school, batch and Academicyear.

Answer 1

In VBScript you can use the ampersand (&) symbol to concatenate strings. Try this:
strSqlData="select * from MyTable where gender='male'"
if AcademicYear <> "" then
strSqlData= strSqlData & " and AcademicYear=" & AcademicYear
end if
if Batch <> "" then
strSqlData= strSqlData & " and Batch=" & Batch
end if
if School <> "" then
strSqlData= strSqlData & " and School=" & School
end if
You have three separate "and" clauses to append to your sql query. The conditional statements are independent of each other so you shouldn't be using elseif which is for different options within a single conditional statement. It's simpler to check whether or not a string isn't empty if stringname <> "" than using len, (and I doubt your conditional statements would work because you appear to be using a lower case letter "o" where you should be using a zero)
It's very easy to make mistakes when you're assembling sql queries like this. In testing it's often worth adding a line like Response.Write strSqlData before you try to execute it to check that the query is what you were intending
As other comments have suggested though, your code is vulnerable to an SQL injection attack. Urls which contain ".asp?" can almost be guaranteed to be hit by an ASPROX type attack sooner or later. Parameterised queries are the best means of guarding against this, but one quick approach if your querystring values are all numeric is to use cint() - eg
strSqlData= strSqlData & " and AcademicYear=" & cint(AcademicYear)
This will throw a type mismatch error if the querystring contains anything other than numbers, and the script will fall over before it attempts to execute your sql query.

Answer 2

Instead of creating a sql query in your asp page you may create a Store Procedure and call it on your ASP page with the required parameter from your Query String.
Here is the sample SP which I have created as per your asked scenario
CREATE PROCEDURE Sp_fetch_data #school VARCHAR(max),
#batch VARCHAR(max),
#academicYear VARCHAR(max)
AS
BEGIN
SET #school = (SELECT CASE
WHEN #school = '' THEN NULL
ELSE #school
END)
SET #batch = (SELECT CASE
WHEN #batch = '' THEN NULL
ELSE #batch
END)
SET #academicYear = (SELECT CASE
WHEN #academicYear = '' THEN NULL
ELSE #academicYear
END)
SELECT *
FROM mytable
WHERE gender = 'male'
AND school = #school
AND batch = #batch
AND academicyear = #academicYear
END
Now simply call this SP in your ASP page:
strSqlData = "sp_fetch_data'"&Request.QueryString("school")&"','"&Request.QueryString("batch")&"','"&Request.QueryString("academicYear")&"'"
EDIT:Execute Store Procedure with NULL data
ALTER PROCEDURE Sp_fetch_data #school VARCHAR(max) = NULL,
#batch VARCHAR(max) = NULL,
#academicYear VARCHAR(max) = NULL
AS
BEGIN
SELECT *
FROM mytable
WHERE gender = 'male'
AND ( #school = school
OR #school IS NULL )
AND ( #batch = batch
OR #batch IS NULL )
AND ( #academicYear = academicyear
OR #academicYear IS NULL )
END

Answer 3

You should think the problem only as a string creation. You have to create a string that will be a correct sql query.
The approach that you have tried wants to create a query that contains logical statements. Instead of that, you should write your C# code in a way to create a proper sql query.
For an example, let's take the first part of your query:
strSqlData="select * from MyTable where gender="male"
if len(AcademicYear)<>o then
and AcademicYear='"&AcademicYear&"'
You can easily transfer that for a proper C# solution something like that:
string strSqlData;
int AcademicYear = 1994;
int o = 2000;
string male = "male";
strSqlData="select * from MyTable where gender= " + male;
if (AcademicYear != o)
strSqlData += " and AcademicYear=" + AcademicYear.ToString();
Console.WriteLine(strSqlData);
Actually after you have fixed that part of your code, there will be some additional to do that you have to do. For example, your should use parametrized queries instead of hard coding an sql string.
Maybe you should find an example about building data access layer.