Validate last 2 letters into dynamic query - asp.net

Question

Im doing a Dynamic Query into ASP.NET using SQL Server 2016.
Basically i have some checkbox and textbox:
<asp:CheckBox ID="chk_Precio" runat="server" OnCheckedChanged="chk_Precio_CheckedChanged" AutoPostBack="true" />
<asp:TextBox ID="txtPrecio" runat="server" CssClass="enjoy-css" style="margin-bottom: 0"></asp:TextBox>
<asp:CheckBox ID="chk_Modelo" runat="server" AutoPostBack="true" OnCheckedChanged="chk_Modelo_CheckedChanged" />
<asp:TextBox ID="txtModelo" runat="server" CssClass="enjoy-css" style="margin-bottom: 0"></asp:TextBox>
<asp:Button ID="btnBuscar" CssClass="button" runat="server" Text="Buscar" OnClick="btnBuscar_Click" />
These are validated in chk_Modelo_CheckedChanged.
Inside btnBuscar_Click i have:
protected void btnBuscar_Click(object sender, EventArgs e)
{
string query = "SELECT p.OrderId AS Orden, p.OrderDate as Fechadecompra, '$'+Convert(varchar,convert(money,p.Amount),1) as PrecioCompra, c.ModelCar as Modelo, b.Description_Brand as Marca, c.Color, t.Description_Transmision as Transmision, s.StatusName AS Estado FROM PurchaseOrder AS p INNER JOIN Cars AS c ON p.IdCar = c.IdCar INNER JOIN Brand AS b ON c.IdBrand = b.IdBrand INNER JOIN TransmisionType AS t ON c.IdTransmision = t.IdTransmision INNER JOIN Status AS s on c.IdStatus = s.IdStatus where ";
string varprecio = txtPrecio.Text;
string varModelo = txtModelo.Text;
try
{
if (varprecio != "")
{
query += "(p.Amount = '"+varprecio +"') or";
}
else if(varModelo != "")
{
query += "(c.ModelCar = '"+varModelo +"') or";
}
string str = "Data Source=DESKTOP-77G5EDB\\SQLEXPRESS;Initial Catalog=TallerDB;Integrated Security=True";
SqlConnection sqlConnection = new SqlConnection(str);
SqlCommand cmd = new SqlCommand(query, sqlConnection);
sqlConnection.Open();
SqlDataReader dr = cmd.ExecuteReader();
dtgv_Compras.DataSource = dr;
dtgv_Compras.DataBind();
}
catch (Exception ex)
{
Response.Write("<script>alert('ERROR: " + ex.Message + "')</script>");
}
}
My question is:
How can i validate if my query ends with: OR, delete these OR and my query finish correctly.
query += "(p.Amount = '"+varprecio +"') or";
F.E.:
SELECT p.OrderId AS Orden, p.OrderDate as Fechadecompra, '$'+Convert(varchar,convert(money,p.Amount),1) as PrecioCompra, c.ModelCar as Modelo, b.Description_Brand as Marca, c.Color, t.Description_Transmision as Transmision, s.StatusName AS Estado
FROM PurchaseOrder AS p
INNER JOIN Cars AS c ON p.IdCar = c.IdCar
INNER JOIN Brand AS b ON c.IdBrand = b.IdBrand
INNER JOIN TransmisionType AS t ON c.IdTransmision = t.IdTransmision
INNER JOIN Status AS s on c.IdStatus = s.IdStatus where (p.Amount = '5000')
Thanks in advance

Answer 1

I made some changes in your button click.
protected void btnBuscar_Click(object sender, EventArgs e)
{
string query = "SELECT p.OrderId AS Orden, p.OrderDate as Fechadecompra, '$'+Convert(varchar,convert(money,p.Amount),1) as PrecioCompra, c.ModelCar as Modelo, b.Description_Brand as Marca, c.Color, t.Description_Transmision as Transmision, s.StatusName AS Estado FROM PurchaseOrder AS p INNER JOIN Cars AS c ON p.IdCar = c.IdCar INNER JOIN Brand AS b ON c.IdBrand = b.IdBrand INNER JOIN TransmisionType AS t ON c.IdTransmision = t.IdTransmision INNER JOIN Status AS s on c.IdStatus = s.IdStatus ";
string varprecio = txtPrecio.Text;
string varModelo = txtModelo.Text;
try
{
if (varprecio != "" || varModelo != "")
query += "where ";
if (varprecio != "")
{
query += "(p.Amount = '" + varprecio + "')";
if (varModelo != "")
query += " or ";
}
if (varModelo != "")
{
query += "(c.ModelCar = '" + varModelo + "')";
}
string str = "Data Source=DESKTOP-77G5EDB\\SQLEXPRESS;Initial Catalog=TallerDB;Integrated Security=True";
SqlConnection sqlConnection = new SqlConnection(str);
SqlCommand cmd = new SqlCommand(query, sqlConnection);
sqlConnection.Open();
SqlDataReader dr = cmd.ExecuteReader();
dtgv_Compras.DataSource = dr;
dtgv_Compras.DataBind();
}
catch (Exception ex)
{
Response.Write("<script>alert('ERROR: " + ex.Message + "')</script>");
}
}
Hope this will work for you. Please let me know if you will still facing issue.

Answer 2

Try this so you don't have to check whether they are blank or not
query += "('" + varprecio +"' = '''' or p.Amount = '" + varprecio +"') AND"
query += "('" + varModelo +"' = '''' or c.ModelCar = '"+varModelo +"')";
Which will give you
WHERE ('' = '' OR p.amount = '') AND ('' = '' or c.ModelCar = '')
or
WHERE ('abc' = '' OR p.amount = 'abc') AND ('xyz' = '' or c.ModelCar = 'xyz')
so if they are blank they are ignored on the SQL side.

Answer 3

I was trying in my work with oracle and i found this:
SELECT SUBSTR('select * from table where condicion = value or', 1, (LENGTH('select * from table where condicion = value or') - 2))
FROM dual where (SUBSTR ('select * from table where condicion = value or', -2,LENGTH('select * from table where condicion = value or')) = 'or');
Query:
select * from table where condicion = value or
Result:
I'll convert later to transact-sql in case someone uses the code into oracle.