Need help passin arguments

[PushCode]

I'm working with some existing code that not pulling the correct result from the DB. In order to resolve this, I need to further filter the query by passing in an additional argument. I'm not sure how to properly pass it in. As you'll see below, the gridview layer is linked to GetCSIPartNumber in the code-behind layer, which is linked to GetCSIItemId in the data access layer...where a query is then executed. I need to be passing two arguments to this query instead of one. The second argument I need to pass is a "ship to id", which is available on the code-behind layer via either 'ship_to_id' or 'session["closures_ship_to"]'. I've tried several different ways of passing along, but none work. Once it's properly passed in, I hope to add it to the query like so (strSQL += "AND location_id = '" + ship_to_id + "' ". Can someone show me how to do this?
It's a layered approach with the Gridview Layer:

<asp:TemplateField HeaderText="CSI Part #">
    <ItemTemplate>
        <asp:Label ID="lblCSIPartNumber" runat="server" Text='<%# GetCSIPartNumber((string)Eval("ITEM_ID")) %>'></asp:Label>
    </ItemTemplate>
</asp:TemplateField>

The code-behind layer:

public string GetCSIPartNumber(string InventoryItemId)
    {
        return ClosuresSystem.GetCSIItemId((InventoryItemId)).ToString();
    }

And what we call the data access layer:

public static string GetCSIItemId(string InventoryItemId)
    {
        string CustomerItemId = String.Empty;

        try
        {
            string strSQL = string.Empty;
            strSQL = "SELECT DISTINCT ITEM_NUMBER FROM V_CSIDIRECT_CLOSURES_CATALOG WHERE ITEM_PK_KEY = '" + InventoryItemId.ToString() + "' ";
            object obj = m_DataWarehouseDatabase.ExecuteScalar(CommandType.Text, strSQL);

            if (null != obj)
                CustomerItemId = obj.ToString();
        }
        catch (Exception e)
        {
            Logger.Write("Unable to look up the customer item id for inventory item id " + InventoryItemId + ".\n" + e.Message, "Oracle", 1, 25, System.Diagnostics.TraceEventType.Error);
        }

        return CustomerItemId;
    }

 

[jmeckley]

add a second parameter to the method signature. and do not use injected sql. used parameterized queries instead.


Jason Meckley
Programmer
Specialty Bakers, Inc.