John L. DeVito wrote:
My plan is to just 'get it working' and then I will go back over it and and change to parameterized queries
That's a very bad plan. There's a good chance that you'll miss something, or forget to do it, or run out of time, or lose interest and move on to the next project... :) Plus, as others have pointed out, using string concatenation to build your query will introduce new problems that you'll have to fix, which wouldn't be the case if you used properly parameterized queries. Parameterized queries aren't particularly hard, particularly as you're using ADO.NET and SQL Server:
private void searchButton_Click(object sender, EventArgs e)
{
// TODO: This should probably be in the configuration file:
const string ConnectionString = @"Server=MyAzureServer,MyPortNumber;Database=MyDatabase;User ID=me@MyAzureServer;Password=MyPassword;Trusted_Connection=False;Encrypt=True;Connection Timeout=30;";
const string Query = @"SELECT
Title,
Director,
Genre,
ReleaseYear,
Length,
NumberofDisks,
Description
FROM
Base
WHERE
(NullIf(@Title, '') Is Null Or Title = @Title)
AND
(NullIf(@Director, '') Is Null Or Director = @Director)
AND
(NullIf(@Genre, '') Is Null Or Genre = @Genre)
AND
(NullIf(@ReleaseYear, '') Is Null Or ReleaseYear = @ReleaseYear)
AND
(NullIf(@Length, '') Is Null Or Length = @Length)
AND
(NullIf(@NumberOfDisks, '') Is Null Or NumberOfDisks = @NumberOfDisks)
AND
(NullIf(@Description, '') Is Null Or Description = @Description)
;";
DataTable dTable = new DataTable();
using (SqlConnection connection = new SqlConnection(ConnectionString))
using (SqlCommand command = new SqlCommand(Query, connection))
{
command.Parameters.AddWithValue("@Title", titleTextbox.Text);
command.Parameters.AddWithValue("@Director", directorTextbox.Text);
command.Parameters.AddWithValue("@Genre", genreCombobox.GetItemText(genreCombobox.SelectedItem));
command.Parameters.AddWithValue("@ReleaseYear", yearCombobox.GetItemText(yearCombobox.SelectedItem));
command.Parameters.AddWithValue("@Length", lengthTextbox.Text);
command.Parameters.AddWithValue("@NumberOfDisks", numberOfDisksTextbox.Text);
command.Parameters.AddWithValue("@Description", descri
