C#

Glen Harvy wrote:

I have always used the following coding when formatting dates for use with SQL:

bookingMadeDateTime.ToString("yyyy-MM-dd hh:mm:ss tt") <-- or very similar

however I have now been advised by a prospective user that they are using the following formats and the sql insert is failing

Colin Angus Mackay wrote:

Why would you be formatting dates for SQL Statements. Surely you would be passing this as a parameter? If you didn't use parameters your code would be highly susceptable to SQL Injection attacks, which would not be good.

Glen Harvy wrote:

I am happy to rewrite the code as you suggest ie paramaterized however I don't see this as solving the problem at hand ie the user hast his computer to use non-US English.

Does .Net automatically tanslate date formats?

....
commandRecDetails.Append(" VALUES ( '");
commandRecDetails.Append(bookingMadeDateTime.ToString("yyyy-MM-dd hh:mm:ss tt") + "',");
commandRecDetails.Append(" " + courtNumber + ", ");
commandRecDetails.Append(" " + thisBookingNumber.ToString() + ", '");
etc etc....
recordBookingDetails.CommandText = commandRecDetails.ToString();

recordBookingDetails.Parameters.Add("DateMade", bookingMadeDateTime);

lock (obj) {
  //...
}

System.Threading.Monitor.Enter(obj);
try {
	//...
} finally {
	System.Threading.Monitor.Exit(obj);
}

<br />
public static int GetIntFromTextBox(TextBox textbox)<br />
{<br />
    if(textbox != null && !string.IsNullOrEmpty(textbox.Text))<br />
    {<br />
        int myInt;<br />
        <br />
        string myNumberString = textbox.Text;<br />
        int.TryParse(myNumberString, out myInt);<br />
        <br />
        return myInt;<br />
    }<br />
    return 0;<br />
}<br />