Member Avatar for arslanazam90

"SELECT * FROM table where column=" & Request.QueryString("querystringfeild")
i want to add order by condition along with where condition. But i don't know how to write syntax please help me. thanks!

  • 3 Contributors
  • 3 Replies
  • 84 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by xerohomicide

Dani AI

Generated

wanted to append an ORDER BY to a WHERE-based query; correctly reminded that ORDER BY is the sorting clause and showed quoting around a value. The concise rule: the ORDER BY clause comes after WHERE (and after GROUP BY/HAVING if used). List multiple sort columns separated by commas and add ASC or DESC to set direction.

A safer, maintainable pattern in VB.NET is to parameterize the filter value and keep the sort clause either fixed or built from a validated whitelist. Example pattern (ADO.NET):

Dim sql As String = "SELECT Id, Name FROM Employees WHERE Department = @dept ORDER BY LastName ASC, FirstName ASC"

Using conn As New SqlConnection(connString)
Using cmd As New SqlCommand(sql, conn)
cmd.Parameters.Add("@dept", SqlDbType.NVarChar, 50).Value = Request.QueryString("dept")
conn.Open()
' execute and read
End Using
End Using

Avoid concatenating raw QueryString values into SQL. If the user can choose which column to sort by, map their input to a fixed set of allowed column names (Select Case or dictionary) and then append that validated column name to the ORDER BY clause. For syntax details see the Microsoft ORDER BY documentation and use parameterized ADO.NET commands to prevent injection (Microsoft docs and OWASP discuss SQL injection mitigation).

Recommended Answers

All 3 Replies

Member Avatar for Sahil89

select * from table ORDER BY empID

Member Avatar for arslanazam90

no i mean i want to wirte order by after where condition bu i dont know syntax i mean where to write commas or collan etc please help me in syntax

Member Avatar for xerohomicide

SELECT * FROM table where column='" & Request.QueryString("querystringfeild") &"' ORDER BY table_field"

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.