Search Engine (C#)

[timothy2l]

Search Engine

 

I am working on a search engine for an Online Advising application. The search is set up to either bring up a course code or course name depending on what the user enters in the text box. The problem is that if a user only enters one or two letters, the search may bring up data where the string they entered appears in the middle of a word instead of the beginning.

 

 

 

dtvwCourses.RowFilter = "course_code LIKE '*" + search_str + "*' OR course_name LIKE '*" + search_str + "*'";

 

 

can someone take a look at the code and see if they see any errors or possible improvements?

Thanks in advance

[Nerseus]

If the search string is:

Bob's Diner

OR

'; DELETE TABLE Table1 --

 

You might run into problems...

 

Make sure you double up your single quotes or you will get unexpected results and maybe worse. Use something like:

dtvwCourses.RowFilter = "course_code LIKE '*" + search_str.Replace("'", "''") + "*' OR course_name LIKE '*" + search_str.Replace("'", "''") + "*'";

 

Of course, I should mention that the above code (your original search) is extremely inefficient. Normally having one search that uses * on both sides is bad, but to have two of them with an OR is just... so slow. If you get any more than a few hundred records you'll be having to change some code I'd imagine.

 

-nerseus

[begin_with_A]

Thanks Nerseus, ... that helped me too...

 

-A

http://www.autojobapply.com/

[send your resume to thousands of job-openings within minutes! Automate your job hunt!]