Constructing a good search query using system.data.oracleclient
I am constructing a search function in a class to be used by several of our asp pages. The idea is simple, take a search term from the user and query the database for the item. Currently I am doing this the wrong way, which is vulnerable to SQL injection attacks (and ELMAH is in there to save the day if something goes wrong): Public Shared Function SearchByName(ByVal searchterm As String) As DataTable SearchByName = New DataTable Dim con As New OracleConnection(System.Configuration.ConfigurationManager.ConnectionStrings("OracleDB").ConnectionString) Try con.Open() Dim SqlStr As String =