Taking User Input in SQL SELECT TOP query - sql

Question

I need to acquire the sum of the least n number of values from a table
Dim lot As String = "SELECT SUM(x2) AS x3 FROM (SELECT TOP '" & _TextBox2.Text & "' x1 As x2
FROM (
SELECT SharePrice As x1
FROM Shares
WHERE(Company = '" & _TextBox1.Text & "' AND Availability = True)
ORDER BY SharePrice ASC )
)"
I dont have problems witha nything else but the TOP '" & _TextBox2.Text & "' part
Does the SELECT TOP really take parameters in?
I can replace the textbox reference with a hard coded integer and it works. But i want to make it run In visual Basic with user input

Answer 1

You cannot use single quotes around the number in the TOP n portion of the query.
Change:
SELECT TOP '" & _TextBox2.Text & "'
To:
SELECT TOP " & _TextBox2.Text & "
I also recommend that you use a parametrized query to help prevent SQL Injection.

Answer 2

It's a lot easier to do this as a parameterized query. In addition to preventing sql injection attacks it avoids the problems of when to put quotes around things.
In order to get Top to work you will need to surround the parameter name with parens
Dim lot As String = " SELECT SUM(x2) AS x3
FROM
(SELECT TOP (#Top) x1 As x2
FROM (SELECT
SharePrice As x1
FROM Shares
WHERE
(Company = #CompanyName
AND Availability = True)
ORDER BY SharePrice ASC ))"
Dim cmd as SqlCommand = new SqlCommand (connection, lot)
cmd.AddWithValue (#Top, Int32.Parse(_TextBox2.Text))
cmd.AddWithValue (#CompanyName, _TextBox1.Text)