title: Build SQL query string using user input
body: <p>I have to make a string by using the values which the user selects on the webpage,</p>
  
  <p>Suppose I need to display files for multiple machines with different search criteria...</p>
  
  <p>I currently use this code:</p>
  
  <pre><code>DataTable dt = new DataTable();
  SqlConnection connection = new SqlConnection();
  connection.ConnectionString = ConfigurationManager
                 .ConnectionStrings["DBConnectionString"].ConnectionString;
  connection.Open();
  SqlCommand sqlCmd = new SqlCommand
    ("SELECT FileID FROM Files
      WHERE MachineID=@machineID and date= @date", connection);
  SqlDataAdapter sqlDa = new SqlDataAdapter(sqlCmd);
  
  sqlCmd.Parameters.AddWithValue("@machineID", machineID);
  sqlCmd.Parameters.AddWithValue("@date", date);
  
  sqlDa.Fill(dt);
  </code></pre>
  
  <p>Now this is a fixed query where the user just has one machine and just selects one date...</p>
  
  <p>I want to make a query in which the user has multiple search options like type or size if he/she wants depending on what he/she selects.</p>
  
  <p>Also if he/she can select multiple machines...</p>
  
  <pre><code>SELECT FileID FROM Files
  WHERE (MachineID=@machineID1 or MachineID = @machineID2...)
  AND (date= @date and size=@size and type=@type... )
  </code></pre>
  
  <p>All of this happens at runtime... otherwise I have to create a <code>for</code> loop to put multiple machines one by one... and have multiple queries depending on the case the user selected...</p>
  
  <p>This is quite interesting and I could use some help...</p>