Develop Reference

I made an asp.net mysql query. How can I get the surname data? [closed]

Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 1 year ago.
Improve this question
I made an asp.net mysql query. How can I get the surname data?
MySqlCommand cmd = new MySqlCommand("SELECT * FROM database1 WHERE User_Name=#User_Name", conn);
cmd.Parameters.AddWithValue("#User_Name", kullanici.ToString());
reader = cmd.ExecuteReader();
sonuclbl.Text = reader["surname"].ToString();

Initially, you have to define the type of reader variable. It is not clear from the snippet you shared that you had done show.Then you have to loop through the reader, as it is described here:
var reader = cmd.Execute.Reader();
// Call Read before accessing data.
while (reader.Read())
{
// Your code here to read from the reader
}
Update
From your updated post, it is clear that you need to define the type of variable called reader.

var reader = cmd.Execute.Reader();
while (reader.Read())
{
// your code example below
string variableName = reader["ColumnName"].Tostring();
}

Discovering vulnerabilites in ASP.NET and C# [closed]

Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 5 years ago.
Improve this question
As I am developing an application. How I can find the vulnerabilities which give hackers a chance to attack? And what are the security mechanisms possible here?
For example this code:
foreach (GridViewRow row in USER_GROUP_FROMS.Rows)
{
var chkboxuser = (CheckBox)row.FindControl("mainsupp");
abc = "";
if (chkboxuser.Checked == true)
{
string xe = "DATA SOURCE=technovalms;USER ID=AMC; password=amc;";
OracleConnection conn = new OracleConnection();
conn.ConnectionString = xe;
OracleCommand cmd = new OracleCommand();
cmd.Connection = conn;
conn.Open();
cmd.CommandText = "insert into TECHNOVA_SMS_USER_PRIVILEAGE(ID,SMS_USER_ID,SMS_PAGE_ID) values(SEQUENCEMODEL.nextval,'" + user_type.SelectedValue.ToString() + "','" + chkboxuser + "') ";
cmd.ExecuteNonQuery();
}
}

OWASP is your friend:
https://www.owasp.org/index.php/Main_Page
There is a lot of information in the site, you can start with the Web Application Security Testing Cheat Sheet for a good introduction to the subject and a checklist of tasks to be performed during security testing of a Web application.
EDIT
By the way, the code you have provided is vulnerable to SQL Injection Attacks.
You are appending the contents of your controls directly to your query so a user could input something like the following:
1';DELETE FROM TECHNOVA_SMS_USER_PRIVILEAGE'
Voila! They have access to all your database information.
To avoid this you should always filter user input using parameters:
cmd.CommandText = "insert into TECHNOVA_SMS_USER_PRIVILEAGE(ID,SMS_USER_ID,SMS_PAGE_ID) values(SEQUENCEMODEL.nextval,':selectedValue',':chkboxuser') ";
cmd.Parameters.Add(new OracleParameter("selectedValue", user_type.SelectedValue.ToString()));
cmd.Parameters.Add(new OracleParameter("chkboxuser", chkboxuser));

C# SQL Server command data type mismatch [closed]

Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 5 years ago.
Improve this question
I want to insert record to student table and I used a SqlCommand but when executing command as shown here, a datatype mismatch error occurs.
System.Data.SqlClient.SqlCommand cmd = new System.Data.SqlClient.SqlCommand("insert into Student(studentID,studentName,birthDate) values(" + studentID.Text + ",'" + studentName.Text +"','" + birthDate.Text + "')", con);

You can use parameters to solve this problem like this:
SqlCommand cmd = new SqlCommand("insert into Student(studentID, studentName, birthDate) values(#studentID, #studentName, #birthDate)" , con);
cmd.Parameters.AddWithValue("#studentID", studentID.Text);
cmd.Parameters.AddWithValue("#studentName", studentName.Text);
cmd.Parameters.AddWithValue("#birthDate", birthDate.Text);
cmd.ExecuteNonQuery();

insert multiple records asp.net sql [closed]

Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 7 years ago.
Improve this question
there is a table to store borrowed items called borrowTable, lets say a customer take multiple items, I know how to select and insert a single item but how to select and insert multiple items in a single click?

Take all your data in a datatable(We can call 'myTable' here) and you can insert as follows
string sql = "INSERT INTO MyTable (Col1, Col2) VALUES (#Value1, #Value2)";
using (MySqlConnection con = new MySqlConnection(connectionString))
{
int retvalue;
con.Open();
foreach (DataRow row in myTable.Rows)
{
MySqlCommand myCommand = new MySqlCommand();
myCommand.Connection = con;
myCommand.CommandText = sql;
myCommand.Parameters.AddWithValue("#Value1", r["Value1"]);
myCommand.Parameters.AddWithValue("#Value2", r["Value2"]);
retvalue = myCommand.ExecuteNonQuery();
}
}

The simplest way to copy lots of data from any resources to SQL Server is BulkCopying.
See this example.

How to query from table's view in .Net C#? [closed]

Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 9 years ago.
Improve this question
How to query on table's view in .Net C# web application ?
for example, here [View_App_Academic] is my table view. My code is listed below. under db scheme, I am not able to see the view due to my user privilege.
string strquery = "select * from [dbo].[View_App_Academic] where recruitment_id=" +
RecruitDropDownList.Text + " and ref_no='" + RefDropDownList.Text + "'";
SqlCommand objCMD = new SqlCommand(strquery, conn);

Use parameterized query always.
Remove [dbo] from your query, you don't need to add [dbo] because it is default database schema.
Change your code to this.
string strquery = "select * from View_App_Academic where recruitment_id=#recruitment_id and ref_no=#ref_no";
SqlCommand objCMD = new SqlCommand(strquery, conn);
objCMD.Parameters.AddWithValue("#recruitment_id", RecruitDropDownList.Text);
objCMD.Parameters.AddWithValue("#ref_no",RefDropDownList.Text);
SqlDataAdapter myAdapter = new SqlDataAdapter();
myAdapter.SelectCommand = objCMD;
DataSet myDataSet = new DataSet();
myAdapter.Fill(myDataSet);
Hope it helps.