Adding more than 1 id to search for in SQL - sql-server

Question

Hey all i am in need of some ideas on how to go about doing the following:
I have a textbox that a user can type in an ID to search for in a database. It currently just checks for 1 ID.
Example:
User types in ID 645378
The Query would look like:
SELECT * FROM blahTable WHERE theID = '645378';
Now, i am looking to allow the user to type in more than 1 ID at a time and display those results.
So again an example would be:
User types in ID(s): 645378, 78664, 901524
And now this is where my question comes into play. How can i create a query based on how many ID's the user inputs into the textbox?
Any help would be great!
David

Answer 1

You could use the IN statement in SQL.
SELECT * FROM blahTable where theID in ('123','456','789')
I would advise implementing this via a parametrized query to avoid Bobby Tables (SQL Injection)

Answer 2

Just use IN:
SELECT * FROM blahTable WHERE theID IN (645378, 78664, 901524);
Note that if your values are actual strings and not numbers, then it will require some additional work:
Dim asValues As String()
Dim sbQuery As New System.Text.StringBuilder(5000)
' Get the text, but remove any embedded semi-colons and single quotes for sql injection'
asValues = Miles.Text.Replace(";", " ").Replace("'", " ").Split(New Char() {","c}, StringSplitOptions.RemoveEmptyEntries)
sbQuery.Append("SELECT * FROM blahTable WHERE theID IN (")
Dim fUseComma As Boolean
' Add each value to the query string. In this case, we are wrapping with '
For Each sValue As String In asValues
' Test the value for reasonableness (example only)'
If IsNumeric(sValue) Then
' Only use the comma starting from the second valid item added
If fUseComma Then
sbQuery.Append(",")
Else
fUseComma = True
End If
sbQuery.Append("'").Append(CInt(sValue)).Append("'")
End If
Next
sbQuery.Append(")")
cmd.CommandText = sbQuery.ToString

Answer 3

try this thing.
Dim xIDList As String = "645378, 78664, 901524" 'the user should separate ID by COMMA
Dim xID() As String = xIDList.Split(CChar(",")) 'splits the xIDlist
Dim xIDforQuery As String = String.Empty
For Each oID As String In xID
If oID.Trim.Length <> 0 Then
xIDforQuery &= "," & " '" & oID & "'" ' if ID is not numeric
' xIDforQuery &= "," & oID.ToString ' use this line if ID is numeric
End If
Next
xIDforQuery = xIDforQuery.Trim
xIDforQuery = CStr(IIf(Mid(xIDforQuery, 1, 1) = ",", Mid(xIDforQuery, 2, xIDforQuery.Length - 1), xIDforQuery))
Dim xFinalQuery As String = String.Empty
xFinalQuery = String.Format("SELECT * FROM blahTable where theID in ({0})", xIDforQuery)
' xFinalQuery is the final query statement but this approach is vulberable to SQL Injection.

Answer 4

How do users know which ID's they want? If there aren't too many ID's, using a multiple-selection list-box would improve the UI and simplify the code. If there are too many, then you might consider using an auto-complete text-box for users to choose items that can then be copied (removed) from a list-box to be used by the query.