|
So, yesterday I received a bug "<blablabla> Explain SQL sometimes (!) does not work on Oracle."
Twist, test, try, WTF of course.
The mistery: Format of a string class (almost any).
So here's how (with comments, bells, and COM follies):
String strDest;
String strUser;
strDest.Format(_T("-u%s"), strUser);
Unfortunately, Format call replaces "%s" with "(null)" when a null argument is passed as string.
So the poor receiver attempted to decode the "-u(null)" into an user name, and he gets "(null)".
Then the string horror (of course yet again not validated and unpacked without any defense) was passed to yet another string statement, so it ended up in
"ALTER SESSION SET CURRENT_SCHEMA = (null)"
Obviously a valid string, but probably the customer does not have an user called "(null)".
I hope.
Nuclear launch detected //
|
|
|
|
|
That's why I like to verify all input before passing it on. A couple "if" constructs looking for NULLs and such isn't a bad thing to throw in from time to time.
if (strUser !="") {
strDest.Format(_T("-u%s"), strUser);
} else {
// Add code to complain here
}
Checking for "stupid user tricks" is half the battle of coding! I tend to be very paranoid about anything "editable" by users, and check the bejezzus out of it before passing it along.
|
|
|
|
|
I like checking all input also 
these thumb users always want to hurd me... 
Greetings from Germany
|
|
|
|
|
Your check would still not catch the NULL value. A much better way to validate all strings would be:
if (String.IsNullOrEmpty(strUser)){
throw new ArgumentNullException(strUser);
}
else
{
strDest.Format(...
}
Hope this helps.
.leON.
|
|
|
|
|
Yep - it's a better check, assuming one is working in C# or with .NET.
Personally, I tend to do most of my development in C or C++ without ever touching any .NET stuff, and tend to fall into that pattern instead. It's the nature of my apps being low-level stuff for the most part that drives this, plus I like working with pointers!
|
|
|
|
|
String in my hands, pleases we-mean :
String MyHands = new String("Please who-men");
Kochise
PS : Find the "bugs" in my string or my hands...
In Code we trust !
|
|
|
|
|
First time I saw this post I quickly searched Wikipedia what is a "WTF"... (English is a foreign language anyway).
Greetings - Gajatko
|
|
|
|
|
Being young and foolish, I tried to make a game to keep my fingers busy.
Me knowing nothing, I used a workable idea, ruined it with no campaign-ish structure and mistakes like that. The real problem was the graphics.
Nothing fancy, the graphics consisted of (no fewer than) 700 Imageboxes on the form, layered for textures, objects, people, etc. Also, rather than hide them, they were filled with a blank transparent GIF if it was to display nothing. All but the textures were transparent GIFs, and all the images were loaded from the hard drive every time.
Also, rather than update a few boxes, I had the whole thing re-calculated and re-drawn when the unit moved. I had added a counter Typical values to draw the screen (23x17 grid or so and each had 4 boxes) would be: 0.23 seconds. Per draw. And because the loop was so slow, it would take the best part of 5 seconds to move painfully and flickerously across the screen.
Oh, and I nearly tried to write my own DirectX-style code. In VB6. I'd need a bloomin Double to store the framerate (for the minute value).
Thank God I'm not paid to program...
Yet another spam post on yet another forum!
I am the lazy one, who sleeps as it suits him, codes what he wishes, and has many years to look forward to.
I love being a student.
|
|
|
|
|
Ouch. Are you the guy who wrote the copy folder algorithm for Vista?
Deja View - the feeling that you've seen this post before.
|
|
|
|
|
Ninja-the-Nerd wrote: VB6
I think Chris could as well redirect all Visual Basic posts to the coding horror forum 
Constantly "Saving the day" should be taken as a sign of organizational dysfunction rather than individual skill - Ryan Roberts[^]
|
|
|
|
|
And all VB articles to Purgatory, pending portation to C#?
It's not that bad. It's simple enough for people like me to use it, and there's so many inefficient C based programs it's becoming hard to tell the difference :-P.
I'll have another one soon, I'm porting and completing the VB6 version to VB .NET which should be a right laugh. At least I intend to use GDI for it this time, and use some optimised methods of dropping images.
If any of my future employers see this...[crosses fingers]
"Yes boss, I learned from my mistake"
"No boss, I haven't learned C++"
Yet another spam post on yet another forum!
I am the lazy one, who sleeps as it suits him, codes what he wishes, and has many years to look forward to.
I love being a student.
|
|
|
|
|
C# ones, often, aren't that better.
-- modified at 10:18 Thursday 24th May, 2007
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
|
|
|
|
|
Gruesome.
Guess that's why we have the ability to write Active-X controls in VC?
|
|
|
|
|
VB6 for a game, isnt it to slow. VB6 is outdated I think you should upgrade yourself at least to VB.net or a real programming language.
"Carpe diem"
Greetings from Germany
|
|
|
|
|
That is just the learning process. If we did not make mistakes then we would not learn anything or for that matter – get anything done.
Programmers point of view:
1) Think.
2) Write something based on ideas.
3) Note possible problems – Think.
4) Rewrite – based on what you learned.
5) Think – are you satisfied (learned enough).
6) Make notes – consider improvements.
Management point of view:
1) Think.
2) Write something based on ideas.
3) Does it work?
4) If yes! You are finished – because it works.
5) Stop thinking – for self preservation of sanity.
6) Recommendation – make personal notes – and go on to next subject.
Note: If you do not inform management until step 4 in “Programmers point of view" is complete then you will have a better (more reliable) product. But if you must show progress based on the “Management point of view” then expect to be cut off at the knees, and learn to live with it.
INTP
"Program testing can be used to show the presence of bugs, but never to show their absence."Edsger Dijkstra
|
|
|
|
|
Today I was looking through the code of
student who is working on some project for our company.
He's trying to make a new user admininstration application.
In his application he is loading the users from the database in a treeview.
Ok, so far so good. Nothing is wrong.
Now I've tried to load the user informations and wondered why the data didn't
match to the selected user.
The following code snippet is the reason.
<br />
string query = "ID = " + this.userTree.SelectedNode.Index.ToString();<br />
DataRow[] foundi = tableAdapterUsers.Select(query);<br />
He's making a Select on the Database expecting that
the TreeViewID is equal the Database ID. 
I spend the nearly the whole morning to find this.
I'm wishing everbody a nice weekend
greetings
pdluke
|
|
|
|
|
Youch. When I build TreeNodes from DataRows I store the original DataRow in the Tag field of the TreeNode for future reference.
|
|
|
|
|
pdluke wrote: string query = "ID = " + this.userTree.SelectedNode.Index.ToString();
It is interesting to see people make sql queries this way and expose themselves to SQL injections. Parameterized queries are not only safer, but also easier, IMHO.
|
|
|
|
|
Nemanja Trifunovic wrote: Parameterized queries are not only safer, but also easier
I'm not suggesting I agree with the method shown in by the OP, but it is much easier to keep a source history if the queries are in the code rather than stored procedures and also less likely to miss an update when releasing a new version of code.
That said, i use parameterized queries
Pualee
|
|
|
|
|
You don't have to use stored procedures to use parameterized queries, just put parameters in your queries.
"ID = @id" instead of "ID = '" + id.ToString() + "'"
Using the GridView is like trying to explain to someone else how to move a third person's hands in order to tie your shoelaces for you.
-Chris Maunder
|
|
|
|
|
Pualee wrote: if the queries are in the code rather than stored procedures
I never mentioned stored procedures  . Parameterized queries can be kept in the source code.
|
|
|
|
|
For me, writing on this forum is always a tradeoff between looking stupid and learning more...
Thanks for the clarification
|
|
|
|
|
We use Stored Procedures at the organization I work for, but they have to be created in VS (which is under Source Control) before they can be created on the test database (with each release we submit release notes with files we've modified, created or removed and the person responsible for the builds handles it from there) that way the stored procedures are also under source control.
"Okay, I give up: which is NOT a real programming language????"
Michael Bergman
"Well yes, it is an Integer, but it's a metrosexual Integer. For all we know, under all that hair gel it could be a Boolean."
Tom Welch
"Let's face it, the average computer user has the brain of a Spider Monkey."
Bill Gates
|
|
|
|
|
Or.... just write a function to check all your input fields before processing them? Little things... like making sure numeric values are in "int" and strings are properly quoted out and escaped before concatenating the final SQL string works fine too. Just gotta be careful.
|
|
|
|
|
First code snippet
<br />
for(int i=1;i<=100;i++)<br />
DropDownList1.Items.Add(new ListItem(i.ToString(),i.ToString()));<br />
Second Code Snippet
<br />
DropDownList1.Items.Add(new ListItem("1","1"));<br />
DropDownList1.Items.Add(new ListItem("2","2"));<br />
DropDownList1.Items.Add(new ListItem("3","3"));<br />
DropDownList1.Items.Add(new ListItem("4","4"));<br />
DropDownList1.Items.Add(new ListItem("5","5"));<br />
DropDownList1.Items.Add(new ListItem("6","6"));<br />
DropDownList1.Items.Add(new ListItem("7","7")); <br />
DropDownList1.Items.Add(new ListItem("8","8")); <br />
.<br />
.<br />
.<br />
.<br />
DropDownList1.Items.Add(new ListItem("99","99")); DropDownList1.Items.Add(new ListItem("100","100"));<br />
<br />
Regards,
Sylvester G
sylvester_g_m@yahoo.com
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
