Reading XML file containing SQL statements that require variables from VB.NET program -

i have program written in vb.net , wrote sql statements hard-coded program. wanted try store queries externally in xml file changes can made sql (if needed) without having go code , rebuild program every single time.

the part complicating things sql statements require variables added run properly.

for example:

select name_first, name_last, email_id & eventname

with eventname being variable in program.

when set xml file, tried both of following:

    <data>         <loadsaves>               <sqlstatement><![cdata[select name_first, name_last, email_id &eventname&]]></sqlstatement>         </loadsaves>     </data> 

and

    <data>         <loadsaves>               <sqlstatement><![cdata["select name_first, name_last, email_id from" & eventname]]></sqlstatement>         </loadsaves>     </data> 

i needed cdata because without it, special characters make act weird.

my problem program doesn't substituting of variables because in both methods, program pulls entire thing string.

using first method, able put code in search &eventname& , replaces variable need in there. method worked defeats purpose of having sql externally easy modification, because if of sudden need attendeename instead of eventname, can change in xml file still need change code &attendeename& instead , substitute accordingly.

is there way can handle in more dynamic way instead of having hard coded. said, want able have sql in separate file easy modification if needed without having touch code, keeping in mind each of sql statements require variables added them before can run.

1: bad idea - can mess program or find easy ways hack it.

2: concatenating strings cannot @ run-time, design-time.

3: don't build sql statements using concatenation, can hacked or broken easily. should parameterize sql so:

select name_first, name_last, email_id @eventname 

and when run command use addwithparamter , add parameter , value.

cmd.addwithparameter("@eventname","your value here")