sql server - Best practice for dynamically building variable length IN SQL clause in C# -

Recently I found myself in C #, some SQL is doing. It really is not my area of ​​expertise. Some code is written which looks very ugly, and failed to find a better solution. Here, many answers present SQL injection risks, and essentially I am doing one or the other in the same way. The situation is, I have a form that a user provides a list in a form of store ID. When they click on a button, CRV export will be generated using those stores which provide the exclusion criterion for the query. The way in which I have completed it is setting my SQL string as a constant, then using a string builder in @ x in the IN clause Dynamically attach. This code looks pretty bad, but uses a quick snippet to better explain. For example, the SQL query is that

  private readonly string _SELECT_UNEXPECTED_TOTES = "select table where the table is stored.";  

I do the following (store is an array of strings, SB string builder is):

  // Get enough space for all stores Var sqlParams = New SQLParamator [Store. Length]; Conn.Open (); // Attach our query sb.Append (_SELECT_UNEXPORTED_TOTES); // open these lists sb.Append ("(" "); // list int int = 0; foreach (string in stores) {sb.Append (" @ "); sb.Append (I); Sb. Append (","); I ++;} // trailing simulation, sb.Length - = 1; sb.Append (")"); // actual parameter I = 0; foreign currency (string in stores) {sqlParams [I] = new escapemater ("@" + I, Skldb type variant); sql param [ii] value = s; i ++;}  

later in code I am using these SQL parameters in a SqlStatement object. Is there a better way to accomplish the net? ? I do not know a lot about .NET SQL objects, and for everyone I know that this solution can be screwed as a simple string ... any advice is welcome.

I do not believe there is an easy way to do this with ADO.NET, but as some other users have access to the Entity Framework Mentioned, make it quite cleaner Received and it is not really difficult to set up, especially on a small app. This will convert your above mentioned code to:

  var data = context. TABLE.Where (t = & gt; Store Canton (T. Store)). ToList ();