C#

<Plan1 date="5th may 2009">i have to book a flight today</Plan1>

Miroslav88 wrote:

i already have one xmlfile that i've added to the project, and i want it to store the day

Miroslav88 wrote:

i also want to be able to Load the xmlfile each time i start my project

Miroslav88 wrote:

im a bit new to xml

Le Centriste wrote:

Do you even know C#?

Simon Stevens wrote:

A variant in VB is something that can be any type. The closest equivalent in C# is an 'Object'. In C# all data types derive from Object, so you can return the value as an Object and then cast it to what ever type it actually is.

(By the way, this is rather bad programming style, you should really be using parametrized queries, or stored procedures. This code is very vulnerable to SQL injection attacks. Also, by just chucking objects around everywhere you lose a lot of the benefits of strongly typed languages like C# such as compile time type checking. Also you seem to be repeating your select/case block about 3 times with the same code in it each time, it seems like you might have some redundant code here)

public object GetData(string SQL)
{
     DataTable DT = new DataTable();
     
     DT = dbConn.ExecuteQuery(SQL); dbConn is my connection class

     if (!String.IsNullOrEmpty(DT.Rows[0][0].ToString()))
     {
          switch (DT.Column[0].DataType.ToString())
          {
                case "System.ToInt32":
                    //Code
                    return;
                case "System.String":
                    //code
                    return;
          }
     }
}

string sName;
sName = GetData("Select txtFirstname From tblUsers Where intID = 1").ToString();

klaydze wrote:

Any piece of advise?

GetData("DROP DATABASE [yourdatabase]")

Simon Stevens wrote:

It's unmaintainable and insecure code.

What if some nasty user comes along and calls

GetData("DROP DATABASE [yourdatabase]")

And this is just a minor problem. If you expose the ability to execute arbitrary SQL against your database you can wave goodbye to any serious form of security or data integrity.

If your just writing a prototype or for fun, don't worry about it too much. Just be aware the code is dangerous and should never grow into production code.

If this is production code I would advise a serious rethink about your architecture. You should create a separate data access layer. The DA layer should have strongly typed accessor methods, and they should being using pre written parametrized queries or stored procedures (Google those terms, it's pretty easy to use either with ADO.net)

E.g. you would have a UserDA class with a public User GetUser(String userName) method. The method would run the parametrized query and create a User object to be returned to the caller. This prevents a lot of issues. 1) You are only passing in the user name, not the whole SQL string so the caller can't execute whatever SQL they want. 2) You are returning a strongly typed User object so the caller gets exactly what they are expecting. 3) The use of stored procs or parametrized queries prevents SQL injection attacks. 4) You can build in security if you want and only allow certain users to retrieve and modify certain data.

public object GetData(string SQL)

SELECT * FROM tblUsers WHERE txtUser = sUser

Simon Stevens wrote:

But you should be using parametrized queries not just build up the sql statement on your own out of strings.

public static String GetUser(String userId)
{
    // Create your connection however you normally do it.
    SqlConnection connection = new SqlConnection();

    // Create a sql query with parameters in any place you need user data to be inserted.
    String sqlQuery = "SELECT userName FROM Users WHERE UserId = @UserIdParameter";
    SqlCommand command = new SqlCommand(sqlQuery, connection);

    // Add a parameter for each value entered by the user.
    // By doing it this way, the caller can never inject extra SQL that.
    command.Parameters.Add(new SqlParameter("@UserIdParameter", userId));

    // Execute the reader to run the query.
    using (SqlDataReader reader = command.ExecuteReader())
    {
        if (reader.HasRows)
        {
            return reader.GetString(0);
        }
        else
        {
            return String.Empty;
        }
    }
}

clsConnection myConn = new clsConnection();
DataTable DT = new DataTable();

string SQL = "SELECT * FROM tblUsers";
DT = myConn.ExecuteQuery(SQL);

using System;
using System.Data;
using System.Collections.Generic;
using System.Text;
using System.Data.SqlClient;
using System.Collections;
using System.Windows.Forms;

namespace Micromix.Class
{
    class clsConnection
    {
        public SqlConnection objConnection;
        SqlTransaction objTransaction;


        public bool SqlConnect()
        {

            try
            {
                objConnection = new SqlConnection();
                objConnection.ConnectionString = Connect.ConnString.ToString();
                //objConnection.ConnectionString = "Persist Security Info=False;User ID=sa;Initial Catalog=MICROMIX_PP;Data Source=(local)";
                //objConnection.ConnectionString = "Server=" + GetServer("\\conn.cfg") + "; DataBase=" + GetDatabase("\\conn.cfg") + "; User ID =" + GetUser("\\conn.cfg") + "; Integrated Security=false";

                if (objConnection.State == ConnectionState.Closed)
                    objConnection.Open();

                return true;
            }

            catch (Exception ex)
            {
                MessageBox.Show("Failed to connect to data source.", "Connect Failed", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                MessageBox.Show(ex.Message);
                return false;
            }

            finally
            {
                objConnection.Close();

            }

        }

        public DataTable ExecuteQuery(string strSQL)
        {
            DataTable objDataTable;
            SqlDataAdapter objDataAdapter;

            try
            {

                SqlConnect();
                objDataAdapter = new SqlDataAdapter();

                {

                    objDataTable = new DataTable();
                    objDataAdapter.SelectCommand = new SqlCommand(strSQL, objConnection, objTransaction);
                    objDataAdapter.Fill(objDataTable);

                    return objDataTable;
                }

            }

            catch (Exception sqlex)
            {
                throw sqlex;
            }
            finally
            {
                objDataAdapter = null;

            }
        }

        public void ExecuteNonQuery(string strSQL)
        {
            SqlCommand objSqlCommand;

            try
            {
                SqlConnect();
                objSqlCommand = new SqlCommand(strSQL, objConnection);
                objSqlCommand.Connection.Open();
                objSqlCommand.ExecuteNonQuery();
            }

            catch (SqlException ex)
            {
                throw ex;
            }
            finally
            {
                objSqlCommand = null;

            }
        }

        public bool ExecuteNonQuery(string strSQL, SqlParameter[] sqlparams)
        {

            try
            {
                int intindex;
                SqlCommand objsqlcommand = new SqlCommand(strSQL, objConnection, objTransaction);

                for (intindex = 0; intindex <= sqlparams.GetUpperBound(0); intindex++)
                {
                    objsqlcommand.Parameters.Add(sqlparams[intindex]);
                }

                objsqlcommand.ExecuteNonQuery();
                return true;
            }

            catch (Exception ex)
            {

                throw ex;

            }
        }
    }