Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 9 years ago.
Improve this question
How to query on table's view in .Net C# web application ?
for example, here [View_App_Academic] is my table view. My code is listed below. under db scheme, I am not able to see the view due to my user privilege.
string strquery = "select * from [dbo].[View_App_Academic] where recruitment_id=" +
RecruitDropDownList.Text + " and ref_no='" + RefDropDownList.Text + "'";
SqlCommand objCMD = new SqlCommand(strquery, conn);
Use parameterized query always.
Remove [dbo] from your query, you don't need to add [dbo] because it is default database schema.
Change your code to this.
string strquery = "select * from View_App_Academic where recruitment_id=#recruitment_id and ref_no=#ref_no";
SqlCommand objCMD = new SqlCommand(strquery, conn);
objCMD.Parameters.AddWithValue("#recruitment_id", RecruitDropDownList.Text);
objCMD.Parameters.AddWithValue("#ref_no",RefDropDownList.Text);
SqlDataAdapter myAdapter = new SqlDataAdapter();
myAdapter.SelectCommand = objCMD;
DataSet myDataSet = new DataSet();
myAdapter.Fill(myDataSet);
Hope it helps.
Related
Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 5 years ago.
Improve this question
As I am developing an application. How I can find the vulnerabilities which give hackers a chance to attack? And what are the security mechanisms possible here?
For example this code:
foreach (GridViewRow row in USER_GROUP_FROMS.Rows)
{
var chkboxuser = (CheckBox)row.FindControl("mainsupp");
abc = "";
if (chkboxuser.Checked == true)
{
string xe = "DATA SOURCE=technovalms;USER ID=AMC; password=amc;";
OracleConnection conn = new OracleConnection();
conn.ConnectionString = xe;
OracleCommand cmd = new OracleCommand();
cmd.Connection = conn;
conn.Open();
cmd.CommandText = "insert into TECHNOVA_SMS_USER_PRIVILEAGE(ID,SMS_USER_ID,SMS_PAGE_ID) values(SEQUENCEMODEL.nextval,'" + user_type.SelectedValue.ToString() + "','" + chkboxuser + "') ";
cmd.ExecuteNonQuery();
}
}
OWASP is your friend:
https://www.owasp.org/index.php/Main_Page
There is a lot of information in the site, you can start with the Web Application Security Testing Cheat Sheet for a good introduction to the subject and a checklist of tasks to be performed during security testing of a Web application.
EDIT
By the way, the code you have provided is vulnerable to SQL Injection Attacks.
You are appending the contents of your controls directly to your query so a user could input something like the following:
1';DELETE FROM TECHNOVA_SMS_USER_PRIVILEAGE'
Voila! They have access to all your database information.
To avoid this you should always filter user input using parameters:
cmd.CommandText = "insert into TECHNOVA_SMS_USER_PRIVILEAGE(ID,SMS_USER_ID,SMS_PAGE_ID) values(SEQUENCEMODEL.nextval,':selectedValue',':chkboxuser') ";
cmd.Parameters.Add(new OracleParameter("selectedValue", user_type.SelectedValue.ToString()));
cmd.Parameters.Add(new OracleParameter("chkboxuser", chkboxuser));
Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 5 years ago.
Improve this question
I want to insert record to student table and I used a SqlCommand but when executing command as shown here, a datatype mismatch error occurs.
System.Data.SqlClient.SqlCommand cmd = new System.Data.SqlClient.SqlCommand("insert into Student(studentID,studentName,birthDate) values(" + studentID.Text + ",'" + studentName.Text +"','" + birthDate.Text + "')", con);
You can use parameters to solve this problem like this:
SqlCommand cmd = new SqlCommand("insert into Student(studentID, studentName, birthDate) values(#studentID, #studentName, #birthDate)" , con);
cmd.Parameters.AddWithValue("#studentID", studentID.Text);
cmd.Parameters.AddWithValue("#studentName", studentName.Text);
cmd.Parameters.AddWithValue("#birthDate", birthDate.Text);
cmd.ExecuteNonQuery();
Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 7 years ago.
Improve this question
string conn = "";
conn = ConfigurationManager.ConnectionStrings["Conn"].ToString();
SqlConnection objsqlconn = new SqlConnection(conn);
objsqlconn.Open();
SqlCommand objcmd = new SqlCommand("IF (select 1 from PRODUCT where PRODUCT_NAME=" + Master_product_txt.Text + ")=1
PRINT 'ALREADY AVAILABLE'
ELSE
Insert into PRODUCT(PRODUCT_NAME) Values('" + Master_product_txt.Text + "')
GO", objsqlconn);
objcmd.ExecuteNonQuery();
MessageBox.Show("Details Successfully Added!!!");
I'm trying check the data base values before insert the value, I've wrote query for it, it's working in sql server environment, I could not able to implement same thing in Visual Studio
go is a SSMS (SQL Server Management Studio) statement, it won't work from C#
use parameters to avoid SQL injection
it is unusual to use the Hungarian obj prefix in C#
A quick try at a better version:
var cmd = new SqlCommand(#"
IF NOT EXISTS (SELECT * FROM PRODUCT WHERE PRODUCT_NAME = #NAME)
BEGIN
INSERT INTO PRODUCT (PRODUCT_NAME) VALUES (#NAME)
END
", sqlconn);
cmd.Parameters.AddWithValue("#NAME", Master_product_txt.Text);
cmd.ExecuteNonQuery();
SqlCommand objcmd = new SqlCommand("SELECT 1 from PRODUCT WHERE PRODUCT_NAME=#NAME" , objsqlconn);
//NVarChar
cmd.Parameters.Add("#NAME", SqlDbType.NVarChar,20).Value = Master_product_txt.Text;
objsqlconn.Open();
readr = SelectCommand.ExecuteReader();
if (!readr.HasRows)
{
`// code to insert values here.
}`
PRINT 'ALREADY AVAILABLE' will not work here.For capturing print statement message you have to add an event handler to the InfoMessage event on the connection.And use parametrized query where ever possible. ;)
Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 7 years ago.
Improve this question
there is a table to store borrowed items called borrowTable, lets say a customer take multiple items, I know how to select and insert a single item but how to select and insert multiple items in a single click?
Take all your data in a datatable(We can call 'myTable' here) and you can insert as follows
string sql = "INSERT INTO MyTable (Col1, Col2) VALUES (#Value1, #Value2)";
using (MySqlConnection con = new MySqlConnection(connectionString))
{
int retvalue;
con.Open();
foreach (DataRow row in myTable.Rows)
{
MySqlCommand myCommand = new MySqlCommand();
myCommand.Connection = con;
myCommand.CommandText = sql;
myCommand.Parameters.AddWithValue("#Value1", r["Value1"]);
myCommand.Parameters.AddWithValue("#Value2", r["Value2"]);
retvalue = myCommand.ExecuteNonQuery();
}
}
The simplest way to copy lots of data from any resources to SQL Server is BulkCopying.
See this example.
Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 8 years ago.
Improve this question
My code needs to save all the information captured in the WinForm Vendita.
I'm using the following code but it doesn't save the information in the DB and gives me an error indicating a data type mismatch in the criteria expression.
I am using the following code:
System.Data.OleDb.OleDbCommand cmd1 = new System.Data.OleDb.OleDbCommand();
System.Data.OleDb.OleDbCommand cmd2 = new System.Data.OleDb.OleDbCommand();
System.Data.OleDb.OleDbCommand cmd3 = new System.Data.OleDb.OleDbCommand();
cmd1.CommandType = System.Data.CommandType.Text;
cmd2.CommandType = System.Data.CommandType.Text;
cmd1.CommandText = "INSERT INTO FattureVoci ([IDVoce],[CodiceArticolo],[Descrizione],[Quantita],[PrezzoUnitario]) VALUES (#Id,#Prod,#Descr,#Qta,#Prezzo)";
cmd2.CommandText = "INSERT INTO Fatture ([Intestatario],[PartitaIVA]) VALUES (#Intest,#Iva)";
cmd1.Parameters.AddWithValue("#Prod", this.Prodotto.Text);
cmd1.Parameters.AddWithValue("#Iva", Convert.ToInt32(this.PartitaIVA.Text));
cmd1.Parameters.AddWithValue("#Descr", this.Descrizione.Text);
cmd1.Parameters.AddWithValue("#Qta", Convert.ToInt32(this.Qta.Text));
cmd1.Parameters.AddWithValue("#Intest", this.Intestatario.Text);
cmd1.Parameters.AddWithValue("#Id", Convert.ToInt32(this.id.Text));
cmd1.Parameters.AddWithValue("#Prezzo", Convert.ToInt32(this.Prezzo.Text));
cmd1.Connection = conn;
conn.Open();
cmd1.ExecuteNonQuery();
cmd2.ExecuteNonQuery();
conn.Close();
}
Iva and Interest belong to cmd2 instead of cmd1. Change this:
cmd1.Parameters.AddWithValue("#Iva", Convert.ToInt32(this.PartitaIVA.Text));
cmd1.Parameters.AddWithValue("#Intest", this.Intestatario.Text);
To:
cmd2.Parameters.AddWithValue("#Iva", Convert.ToInt32(this.PartitaIVA.Text));
cmd2.Parameters.AddWithValue("#Intest", this.Intestatario.Text);
Also, you are using OleDb, so probably Ms Access: you should provide the parameters in the correct order.