Question: I am programming in c# and have used a DataGrid for displaying values from Oracle 10g database. I have a table with attributes Id, Sender, Text, Time, Type, Department, Severity and Confidence level. I want to write a query for filter. I have a textbox in which user can enter any name of sender and only the tuples corresponding to that sender should be displayed in the datagrid. 

If I display the full table in the datagrid then it is working fine whereas for the filter I have written the following query but it is giving NULL result.

```
SELECT        E_ID, SENDER, TEXT, "TIME", "TYPE", DEPT, SEVERITY, CONF_LEV
FROM            EMAIL
WHERE        (SENDER = '" & TextBox1.Text & "')

```

what is the problem with the query??

Answer: 
why not you use SqlCommand Parameters. you can try like this, by using parameterized queries you can avoid sql injections. and do give descriptive names to columns, it will avoid confusions with Sql keywords. 

```
string SqlString = "SELECT E_ID, SENDER, TEXT, 'TIME', 'TYPE', DEPT, SEVERITY, CONF_LEV FROM EMAIL WHERE SENDER =@sender"

using(SqlCommand cmd = new SqlCommand(SqlString , conn))
{
  cmd.Parameters.AddWithValue("@sender", Textbox1.Text); 
  cmd.ExecuteNonQuery(); 
}

```
It's a simple issue.
I think one nice way is to get all the data using your Query and store it in a datatable.
Then you can apply filter based on the required condition.

```
   //DataTable table = DataSet1.Tables["0"];
    // Presuming the DataTable has a column named Date.
    string expression;
    expression = "SENDER LIKE %"+TextBox1.Text+%";
    DataRow[] foundRows;

    // Use the Select method to find all rows matching the filter.
    foundRows = table.Select(expression); 

```

You can get the corresponding values based on the name.
Read it from 
<http://msdn.microsoft.com/en-us/library/det4aw50.aspx#Y600>

Advantages : Easy,a avoid database calls
Disadvantages : Initial time consumption is very high, but can avoid db calls.