ASP.NET More on searching databases 1ASP.NET, More on searching databases

The SQL LIKE operator The SQL LIKE operator allows you to use wildcards when comparing text strings – SELECT* FROM book WHERE title LIKE ’ASP%’ Any title starting with ASP % means a series (possibly empty) of characters – SELECT* FROM book WHERE title LIKE ’%ASP%’ Any title that contains ASP – SELECT* FROM book WHERE title LIKE ’ASP.NET _._%’ _ means one character Visual Studio can help you create LIKE based comparisons Examples – books/SearchTitle.aspx, – Books/SearchTitleBehind.aspx Gives you the opportunity to write “no books found” 2ASP.NET, More on searching databases

SQL injection The user writes clever (malicious) input for that will make the DBMS do extra (unwanted) things, like – Delete rows – Drop tables Example – Books/SearchTitleBehind.aspx You should check the input string for ”strange” content like semicolon, quotes, etc. Further reading – 3ASP.NET, More on searching databases

Advanced search A form with several fields (TextBoxes, DropDownLists, etc.) – The user decides which fields to fill out. – Only used fields are used in the search Example – Books/SearchTitleBehind.aspx 4ASP.NET, More on searching databases

Adding and extra field to a DropDownList How to add and extra field ”any …” to the top of a DropDownList Example: books/SearchAdvances.aspx – Allows us to append data items to the list – “onselected” is an event that occurs right after the SELECT has executed 5ASP.NET, More on searching databases

Adding and extra field to a DropDownList, code behind // Event handler for the onselected event from SqlDataSource protected void SqlDataSourceLanguage_Selected(object sender, SqlDataSourceStatusEventArgs e) { addExtraElement(this.DropDownListLanguage, "any language"); } // Helper method, re-usable private void addExtraElement(DropDownList control, String text) { ListItemCollection items = control.Items; ListItem item = new ListItem(text, "-1"); items.Insert(0, item); } 6ASP.NET, More on searching databases

Making and executing the advanced search, code behind 1.Compose the WHERE part of the SELECT statement – Lots of IF statement and String concatenations 2.Execute the SELECT statement to produce a DataSet object 3.Assign the DataSet object to the View +Bind – In this case a GridView 7ASP.NET, More on searching databases