Improvement of delete method [closed]

Question

I was wondering if there is a better way to code this:

using (SqlConnection connection = new SqlConnection(ConnectionString)) {
   using (SqlCommand cmdDelete = new SqlCommand("DELETE FROM table WHERE 
         (TestNumber = '" + testNumber + "')", connection)) {
      try
      {
         connection.Open();
         int recordExists = deletePolicyFromTdm.ExecuteNonQuery();
         connection.Close();

         if(recordExists == 1)
            result.Append("Record has been deleted");
         else
           result.Append("Record does not exist");
      ...

Couple of assumptions:

• testNumber is unique and no duplicate records and was input tested, at least according to bus rules. So I realize that if more than one record is present the if statement won't work properly
• Table has a PK but testNumber isn't it
• Only one roundtrip to db
• Can't change how DB is set up
• SQL command will eventually be replaced with a sproc and parameter

The idea is that if user clicks a button and gets either a message that no record exists or that the records were deleted.

Answer 1

A few quick remarks:

1. In your second using statement, you declare a SqlCommand variable named cmdDelete. In the body of that using statement, however, you call ExecuteNonQuery on a variable named deletePolicyFromTdm. I don't see a declaration for deletePolicyFromTdm in your code, so I wonder if it should be cmdDelete instead.

2. I'm not sure where testNumber is coming from, but your approach potentially opens the door for SQL injection. I recommend defining it as a parameterized query (e.g. DELETE FROM table WHERE TestNumber = @TestNumber); it's a very small amount of work and will be one less thing to do when you switch to a sproc later.

3. Your brace style is not consistent. The braces following using are on the same line; the brace following try are on a separate line.