using System;
using System.Data;
using System.Data.SqlClient;
using System.Configuration;
using System.Collections;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;

public partial class _Default : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {

    }

    //get customer data based on search paramater
    // bad practices with string concate
    private DataTable GetCompanyData(string searchKey)
    {
        SqlConnection cn = new SqlConnection();
        cn.ConnectionString = ConfigurationManager.ConnectionStrings["ConnString"].ConnectionString;

        string Sql = "SELECT CompanyName, ContactName, City FROM Customers WHERE CompanyName LIKE '%" + searchKey+"%'"; 

        cn.Open();
        SqlCommand cmd = new SqlCommand(Sql, cn);
        SqlDataReader dr = cmd.ExecuteReader();

        DataTable dt = new DataTable();
        dt.Load(dr);
        return dt;

        cn.Close();
    }
    protected void btnSearch_Click(object sender, EventArgs e)
    {
        try
        {
            GridView1.DataSource = GetCompanyData(TextBox1.Text);
            GridView1.DataBind();
        }
        catch (Exception ex)
        {
            Response.Write(ex.Message);
        }
    }
}
