sqlcommand object parameters

[digitaladdiction]

I am trying to implement a search on a SQL database using a textbox and a dropdownlist. The sql command has two parameters in it that effectively says "SELECT * FROM myTable WHERE @Param1 = @Param2" where Param1 is being set from the drop down list that is a list of the table headers and Param2 is the string in the textbox. This is not working. It compiles but does not return any results.

If I hard code Param1 or the column header in and just leave Param2 the search works fine. When stepping through the code both lines that assign a value to the parameters in the SqlCommand object are assigning the correct values but the commandtext property still shows the parameters as @Param1 and @Param2.

Is there something inherently wrong with this.

[Thing]

Based on your sample query it appears you are comparing both parameters in your query. Why are you doing this? If the two parameters don't match each other then your query won't return any results.

[digitaladdiction]

What I want to do is have the first parameter be the column to search and the second be the value to be looking up in that column. Here is the acctual code in question. if I take @SearchItem and replace it with the constant hostname the querey succesfully returns all row's where the hostname = @SearchQuery. What I am attempting to do though is let the user decide what the search on so they could search any of the columns not just hostname. I have a dropdownlist with the possible collumn names.

    protected void Button1_Click(object sender, EventArgs e)
    {
            SqlConnection conn;
            SqlCommand comm;
            SqlDataReader reader;
            serverDetails.Visible = false;    

            string connection = ConfigurationManager.ConnectionStrings["serverlist"].ConnectionString;
            string sqlquery = "SELECT server_id, hostname, os, description, owner FROM server_info WHERE @SearchItem=@SearchQuery";

            conn = new SqlConnection(connection);
            comm = new SqlCommand(sqlquery, conn);

            String searchQuery = searchBox.Text;
            String searchItem = DropDownList1.SelectedValue.ToString();

            comm.Parameters.Add("@SearchQuery", System.Data.SqlDbType.VarChar);
            comm.Parameters["@SearchQuery"].Value = searchQuery;
            comm.Parameters.Add("@SearchItem", System.Data.SqlDbType.VarChar);
            comm.Parameters["@SearchItem"].Value = searchItem;

            try
            {
                conn.Open();
                reader = comm.ExecuteReader();
                GridView1.DataSource = reader;
                GridView1.DataKeyNames = new string[] { "server_id" };
                GridView1.DataBind();
                reader.Close();
            }
            finally
            {
                conn.Close();
            }
        
    }

[cobra124]

I would just concatenate sqlquery to get the field name from the dropdown. Then just worry about the actual value parameter - something like:

string sqlquery = "SELECT server_id, hostname, os, description, owner FROM server_info WHERE " + DropDownList1.SelectedValue.ToString() + " = @SearchQuery";

[digitaladdiction]

Thanks this works perfectly. Not sure why my first way did not but I am not picky, it works, Im happy.