Develop Reference

This is a standard query and i need to change it as parameterized one for saving that from sql injection. can someone give me an answer for this?

var filteredData = context.getProviderData
.FromSqlRaw("exec getProviderData #filter='" + filter + "', #pageSize=" + rows + ", #pageIndex=" + page + ", #allProviders=" + allProviders + ", #Colname='" + sidx + "', #sort='" + sord + "', #Terminatedproviders='" + TerminatedProviders + "', #Prpr_entity='F'")
.ToList();

As per the documentation,
var filteredData = context
.getProviderData
.FromSqlRaw(#"exec getProviderData
#filter,
#pageSize=#rows,
#pageIndex=#page,
#allProviders,
#Colname=#sidx,
#sort=#sord,
#Terminatedproviders,
#Prpr_entity='F'",
filter,
rows,
page,
allProviders,
sidx,
sord,
Terminatedproviders)
.ToList();

Windows App c# SQLlite Database Query

Really new to SQL and I have spent days trying to do queries in my windows store app but can not get the where clause to work
I use the following code to query my database
string query = string.Empty;
public async Task<List<CityClass>> GetListCities(int fred)
{
List<CityClass> objLstCoty = new List<CityClass>();
try
{
query = "Select " + DBColumns.Id + "," + DBColumns.WORKNUM + "," + DBColumns.FAULTREF + " from " + DataBaseWrapper.Cities;
objLstCoty = await con.QueryAsync<CityClass>(query);
tb1.Text = "ID: " + objLstCoty[fred].Id;
tb2.Text = "Fault Ref: " + objLstCoty[fred].FAULTREF;
tb3.Text = "Work Number: " + objLstCoty[fred].WORKNUM;
}
catch (Exception ex)
{
//return null;
throw ex;
}
return objLstCoty;
}
This query 3 columns in my database and puts the data into 3 textboxs
How do I add a where statement so that it only returns the data where the WORKNUM equals a certain number eg WORKNUM = "112000"
I Thought adding + " where " + DBColumns.WORKNUM = "112000"; would work but it does not
Any Help is appreciated
Mark

Thanks for all your help guiding me in the right direction I managed to get it to work using
var ITEM = db.Query("Select * From Cities where WORKNUM='" + srcnum + "' ").FirstOrDefault();
where srcnum is the number i wanted to search for in the WORKNUM column
i can then just fill the textblocks using item.[columnname]
Mark

Looking at how you would add that WHERE clause to the end of your query, it wouldn't even compile as the = sign is outside of the string you're building up.
Try doing the following:
query = "Select " + DBColumns.Id + "," + DBColumns.WORKNUM + "," + DBColumns.FAULTREF + " from " + DataBaseWrapper.Cities + " where " + DBColumns.WORKNUM + " = 112000";

Error while running update query for access database

This is my code:
OleDbConnection con = new OleDbConnection("provider=microsoft.jet.oledb.4.0;data source=" + Application.StartupPath + "/shoping mall.mdb");
con.Open();
OleDbCommand cmd = new OleDbCommand("update RecordofItems set RecordofItems.Bill_no = " + textBox1.Text + ", RecordofItems.Received_from = '" + textBox62.Text + "', RecordofItems.Item_Code = " + textBox2.Text + ", RecordofItems.Quantity = " + textBox32.Text + ", RecordofItems.Sale_Rate = " + textBox47.Text + " where Item_Name = '" + textBox17.Text + "'", con);
int x = 0;
x = cmd.ExecuteNonQuery();
if (x > 0)
{
MessageBox.Show("record deleted" + x);
}
else
{
MessageBox.Show("no record exixt");
}
con.Close();
I want to update selected columns in my "RecordofItems" table that has 10 columns but I want to update only 6 selected columns, when I run the query it shows error "no value for one or more required paremeter" What to do ? please help me as soon as you can.

the error No value given for one or more required parameters usually comes when you have misplaced single quote.
try these two.
try assigning your numerical db columns a numerical value viz update your query with these:
RecordofItems.Bill_no = " + Convert.ToInt32(textBox1.Text) + ",
RecordofItems.Item_Code = " + Convert.ToInt32(textBox2.Text) + ",
RecordofItems.Quantity = " + Convert.ToInt32(textBox32.Text) + ",
RecordofItems.Sale_Rate = " + Convert.ToInt32(textBox47.Text) +
or use whatever suitable numerical converter applies to your columns.
one of your text fields might have a single quote in it, so try replacing/updating your text fields like this:
RecordofItems.Received_from = '" + textBox62.Text.Replace("'","''") + "',
so basically, replace single quote with two single quotes.
see if these solve your issue.
Also, do note, never create your sql query by concatenating textboxes(strings). use command parameters. they will save you from sql injection.

Update/Insert into table

I have to update table on SQL Server but first i have to check for existing data in table so if data is there update it, if not make a new insert:
cmd_sql.CommandText = " SELECT BrDok as id_dok " +
" FROM ordersstavke " +
" WHERE SifParFil = '" + rw_mat["sifskl_kor"] + "'" +
" AND DokumentTip = '" + rw_mat["vrst_dok"] + "'";
MySqlDataAdapter sql_adapter = new MySqlDataAdapter(cmd_sql);
DataSet dt_dok = new DataSet("DOK_MAT_EXCHANGE");
sql_adapter.Fill(dt_dok);
if (dt_dok.Tables["DOK_MAT_EXCHANGE"].Rows.Count == 0)
{
myQuery = " INSERT INTO ordersstavke (BrDok, DocumentTip, SifParFil) " +
" VALUES ('" + rw_mat["brdok"] + "', '" +
rw_mat["vrst_dok"] + "', '" +
rw_mat["sifskl_kor"] + "')";
}
else
{
UPDATE DATA
}
But I have an error in the code, the error is here if (dt_dok.Tables["DOK_MAT_EXCHANGE"].Rows.Count == 0)
Object reference not set to an instance of an object.
The problem is in this if statement...

DOK_MAT_EXCHANGE is the name of the DataSet, not of the first table.
You should test with
if (dt_dok.Tables[0].Rows.Count == 0)
Also, I think is better to use a syntax like this to discover how many records are presents
cmd_sql.CommandText = "SELECT COUNT(BrDok) as id_dok " +
" FROM ordersstavke " +
" WHERE SifParFil = ?p1 " +
" AND DokumentTip = ?p2";
cmd_sql.Parameters.AddWithValue("?p1", rw_mat["sifskl_kor"] );
cmd_sql.Parameters.AddWithValue("?p2", rw_mat["vrst_dok"] );
int rowCount = (Int32)cmd_sql.ExecuteScalar();

change
DataSet dt_dok = new DataSet("DOK_MAT_EXCHANGE");
to
DataSet dt_dok = new DataSet("ordersstavke ");
and
if (dt_dok.Tables["DOK_MAT_EXCHANGE"].Rows.Count == 0)
to
if (dt_dok.Tables["ordersstavke "].Rows.Count == 0)

Accessing the first table via the dataset name is incorrect, that's for setting the XML.
Instead use
dt_dok.Tables[0].Rows.Count;
That being said, you're better off writing this as a single SQL statement instead of a separate select && insert. This way you're not going to the DB multiple times.
var sql = #"if exists(select * from ordersstavke where SifParFil = ? and DokumentTip = ?)
then
-- do insert statement
else
-- do update
end if";
This might also be better done with a stored proc, so you don't have as much SQL code in C#. It's easier to manage multiple operations that way.
And for crying out loud, use SqlParameters, not string concatenation! That's just asking for trouble!

Ok, thanks guys, I wrote it like this
if (ds_dok.Tables[0].Rows.Count <= 0)
{
myQuery = " INSERT INTO ordersstavke (BrDok, " +
" SifParFil) " +
" VALUES ('" + rw_mat["brdok"] + "', '" +
rw_mat["sifskl_kor"] + "')";
}
else if (ds_dok.Tables[0].Rows.Count >= 1)
{
myQuery = "UPDATE ordersstavke " +
"SET BrDok = '" + rw_mat["brdok"] + "', " +
"SifParFil = '" + rw_mat["sifskl_kor"] + "', " +
"WHERE BrDok = " + ds_dok.Tables["ordersstavke"].Rows[0]["BrDok"].ToString() + "'";
}
But there is a small problem in the section update: s_dok.Tables["ordersstavke"].Rows[0]["BrDok"].ToString(), here it give me that loving error : Object reference not set to an instance of an object.
Maybe the update on MySQL goes on different way, I'm referencing on example on sql server and there update goes differently

C# mysql parameters, point column error

Using the code I keep getting the error "Cannot get geometry object from data you send to the GEOMETRY field" However, if i copy and paste the string into an MySQL editor the query runs fine. Any thoughts?
string geoPOINTSTRING = splitZippy[4] + " " + splitZippy[5];
string atGvar = "GeomFromText('Point(" + geoPOINTSTRING + ")');";
string mySQLfinishedProcessing = " insert into zipcodes " +
"set zipcode = '" + zipcodeString + "'" +
",State = '" + StateString + "'" +
",City = '" + CityString + "'" +
",GEOPoint = #g"+
",StateCode = '" + StateCodeString2 + "'";
MySqlConnection configCON = new MySqlConnection(SQLStringClass.zipCONString);
MySqlCommand CounterLogs = new MySqlCommand(mySQLfinishedProcessing, configCON);
CounterLogs.Parameters.AddWithValue("#g",(string)atGvar);
configCON.Open();
CounterLogs.ExecuteNonQuery();
configCON.Close();

You are completely misusing parameters.
A parameter is a raw value.
You're setting GEOPoint to the literal string GeomFromText('Point(something)');
You need to put the actual values in parameters—zipcodeString, StateString, CityString, geoPOINTSTRING, and StateCodeString2.
You would then write GEOPoint = GeomFromText(#pointString), where pointString is a parameter holding "Point(" + geoPOINTSTRING + ")" (The string you want to pass to GeomFromText)