parameterized SQL queries or concatenation

I have a custom search form with 59 control fields for drillers to search for well logs. Right now I am concatenating strings together to build a sql statement. How can I convert what I have to a parameterized query:

If HasValue(DDLCounty1.Text) Then
strCounty1 = "(CNTY_CODE = '" & DDLCounty1.Text & "'"
ReturnHasValueCount += 1
If HasValue(DDLTownship1.Text) Then
strTownship1 = " TWP_CODE = '" & DDLTownship1.Text & "'"
strCounty1 += " AND " & strTownship1 & ") OR "
Else
strCounty1 += ") OR"
End If
End If
........Same for county2 and township2 and so on.

What I don't understand is parameterized goes like this:

objConnection.Open();
SqlCommand objCommand = new SqlCommand(
 "SELECT * FROM User WHERE (County = @dotnet.itags.org.County1 AND Township = @dotnet.itags.org.Township1)" & _
 " OR(County = @dotnet.itags.org.County2 AND Township = @dotnet.itags.org.Township2)",objConnection);
objCommand.Parameters.Add("@dotnet.itags.org.County1",DDLCounty1.Text);
objCommand.Parameters.Add("@dotnet.itags.org.Township1",DDLTownship1.Text);
objCommand.Parameters.Add("@dotnet.itags.org.County2",DDLCounty2.Text);
objCommand.Parameters.Add("@dotnet.itags.org.Township2",DDLTownship2.Text);SqlDataReader objReader = objCommand.ExecuteReader();
if (objReader.Read())
{
...
What if the user just selected county1, township1 and county2. Wouldn't township2
equal null thus returning incorrect records? Township2 should be ignored.
Hope this makes sense. thanks.

Are the 59 control fields all dropdown's? if they are not, what else is mixed in there?

I also have dropdown(14),textbox(40), radio(3) and checkboxes(2).

example:
loweststreetno1 -- highestreetno1 -- streetname1 -- streettype1
loweststreetno2 -- highestreetno2 -- streetname2 -- streettype2
loweststreetno3 -- highestreetno3 -- streetname3 -- streettype3
loweststreetno4 -- highestreetno4 -- streetname4 -- streettype4

Each row is creates an "AND" for each field while the row itself is an "OR" clause.

It should look something like this:
loweststreetno1 = 44
higheststreetno1 = 100
streetname1 = 'main'
streetname 2 = 'high'
streetname4 = 'broad'

STREET_NO BETWEEN 44 and 100 AND STREET_NAME = 'main' OR STREET_NAME = 'high' OR STREET_NAME='broad'

I just don't understand how to parameterized this concept. Thanks for helping.

shominy:

What if the user just selected county1, township1 and county2. Wouldn't township2 equal null thus returning incorrect records? Township2 should be ignored.
Hope this makes sense. thanks.

Did you mean you want to ignore the parameter(s) if it is null? Then you can implement this logic in the query command rather than on the parameter(s). For example:

select * from Orders
where
EmployeeID between 5 and 8
and CustomerID=isnull(@.Cid,CustomerID)
or OrderID = @.Oid
Thank you, thank you. This is exactly what I mean. I hope I understand your query command.

So based on your example this line:CustomerID=isnull(@.Cid,CustomerID)means that if CustomerID is null it will skip it and move on to OrderID=@.Oid? So the sql statement would look like this if

Customerid is null:
Select * from orders where employeeid between 5 and 8 and orderid = 5;

CustomerID Not null:
Select * from orders where employeeid between 5 and 8 and CustomerID = 12 or orderid = 5;

if orderid is null this time:
Select * from orders where employeeid between 5 and 8 and CustomerID = 12;