code not working within if clause

Question

var token = UrlData[1];

var phone_no = UrlData[0];
var db = Database.Open("school");
var rquery = "select st.acno, st.name, sd.cclass, sd.section, cl.nclass from student st join stud sd " +
"on st.acno = sd.acno join clist cl on cl.ccode = sd.cclass" +
" where st.otele like '%" + phone_no.ToString() + "%' ";

if (1 > 0) {
var data = db.Query(rquery);
}
db.Close();

This code runs fine if I remove the if clause. With the If clause, however basic, I get an error. This a webpages projecct.

Dharmeshwaran S · Answer

It's usually safer to wrap inline code in the @{ ... } block to avoid issues. Also it’s good practice to use parameterized queries to prevent SQL injection and other potential issues. Instead of using If condtion Remove if condtion and try below code @{ var token = UrlData[1]; var phone_no = UrlData[0]; var db = Database.Open(school); // Parameterized query to prevent SQL injection var rquery = select st.acno st.name sd.cclass sd.section cl.nclass  + from student st  + join stud sd on st.acno = sd.acno  + join clist cl on cl.ccode = sd.cclass  + where st.otele like @0; var data = db.Query(rquery % + phone_no.ToString() + %); db.Close(); }

kulwant singh · Answer

Hi Dharmeshwaran Thanks for your reply. My actual if condition is like if (token == null || Session[RedirectToken] == null || Session[RedirectToken].ToString() != token) Because the code was not working I was trying with if ( 1 > 0) . if I do not use the if block the code run fine and the page is rendered. But if the code is placed within the if block I get some error and the page is not rendered. Can you please suggest how to use this IF condition in the code above? And your suggestion for using parameterized query is very helpful. I will remember and use for further coding. My code is wrapped within @{...}. I missed it while pasting code here. Thank You! EDITED LATER. I found my mistake. I needed to put dynamic data = null .......before the IF Block.