SqlParameter

Hi, i have code right now with string concatenation like :

sSQL = "select * from table where a=b";

if (current.Request["ct"] != null && current.Request[ct] != "")

{

sSQL += " AND ct = '" + current.Request[ct] + "' ";

}

if (current.Request["dt"] != null && current.Request[dt] != "")

{

sSQL += " AND dt = '" + current.Request[dt] + "' ";

}

and few more (if statements) like these.......

Now i want to use sqlparameters instead for efficiency.

Problem is how can i do that? Do i have to write those if's to concatenate sSQL and then assign it to command object and then write if's again for adding parameters? i am sure there is an efficient way to do this.

thanks

-Samir

Ok samir; we use sql parameter almostly with stored procedures exemple:
Let's say that I develop an application that gives informations about users
I have a Table that stocks data about members
Member(UserId, Password, Mail, Gender)

First I go to Sql Server and I create a stored procedure

CREATE PROCEDURE MemberOrNotMember
(@ID int ,@PASS varchar(20))
AS
SELECT UserId, Pass FROM Member Where UserId=@ID AND Password=@PASS)
RETURN
GO
Once the stroed procedure is created then go now to the application code editor and try to connect to the data base

SqlConnection cn = SqlConnection("Data Source = Provider; Initial Catalog= databasename", Integrated security=true);
SqlCommand cm = new SqlCommand("MemberOrNotMember");
cm.CommandType = CommandType.StoredProcedure;
SqlParameter param1 = new SqlParameter("@ID", SqlType.Int);
SqlParameter param2 = new SqlParameter("@PASS", SqlType.String);
param1.Value = Parse.Int(Text1.text);
param2.Value = Text2.Text;
SqlDataAdapter Adatpter = new SqlDataAdapter(cmd);
DataSet ds = new DataSet();
Adapter.Fill(ds);
Hope that helps you