C#

Simon Stevens wrote:

It's unmaintainable and insecure code.

What if some nasty user comes along and calls

GetData("DROP DATABASE [yourdatabase]")

And this is just a minor problem. If you expose the ability to execute arbitrary SQL against your database you can wave goodbye to any serious form of security or data integrity.

If your just writing a prototype or for fun, don't worry about it too much. Just be aware the code is dangerous and should never grow into production code.

If this is production code I would advise a serious rethink about your architecture. You should create a separate data access layer. The DA layer should have strongly typed accessor methods, and they should being using pre written parametrized queries or stored procedures (Google those terms, it's pretty easy to use either with ADO.net)

E.g. you would have a UserDA class with a public User GetUser(String userName) method. The method would run the parametrized query and create a User object to be returned to the caller. This prevents a lot of issues. 1) You are only passing in the user name, not the whole SQL string so the caller can't execute whatever SQL they want. 2) You are returning a strongly typed User object so the caller gets exactly what they are expecting. 3) The use of stored procs or parametrized queries prevents SQL injection attacks. 4) You can build in security if you want and only allow certain users to retrieve and modify certain data.

public object GetData(string SQL)

SELECT * FROM tblUsers WHERE txtUser = sUser

Simon Stevens wrote:

But you should be using parametrized queries not just build up the sql statement on your own out of strings.

public static String GetUser(String userId)
{
    // Create your connection however you normally do it.
    SqlConnection connection = new SqlConnection();

    // Create a sql query with parameters in any place you need user data to be inserted.
    String sqlQuery = "SELECT userName FROM Users WHERE UserId = @UserIdParameter";
    SqlCommand command = new SqlCommand(sqlQuery, connection);

    // Add a parameter for each value entered by the user.
    // By doing it this way, the caller can never inject extra SQL that.
    command.Parameters.Add(new SqlParameter("@UserIdParameter", userId));

    // Execute the reader to run the query.
    using (SqlDataReader reader = command.ExecuteReader())
    {
        if (reader.HasRows)
        {
            return reader.GetString(0);
        }
        else
        {
            return String.Empty;
        }
    }
}

clsConnection myConn = new clsConnection();
DataTable DT = new DataTable();

string SQL = "SELECT * FROM tblUsers";
DT = myConn.ExecuteQuery(SQL);

using System;
using System.Data;
using System.Collections.Generic;
using System.Text;
using System.Data.SqlClient;
using System.Collections;
using System.Windows.Forms;

namespace Micromix.Class
{
    class clsConnection
    {
        public SqlConnection objConnection;
        SqlTransaction objTransaction;


        public bool SqlConnect()
        {

            try
            {
                objConnection = new SqlConnection();
                objConnection.ConnectionString = Connect.ConnString.ToString();
                //objConnection.ConnectionString = "Persist Security Info=False;User ID=sa;Initial Catalog=MICROMIX_PP;Data Source=(local)";
                //objConnection.ConnectionString = "Server=" + GetServer("\\conn.cfg") + "; DataBase=" + GetDatabase("\\conn.cfg") + "; User ID =" + GetUser("\\conn.cfg") + "; Integrated Security=false";

                if (objConnection.State == ConnectionState.Closed)
                    objConnection.Open();

                return true;
            }

            catch (Exception ex)
            {
                MessageBox.Show("Failed to connect to data source.", "Connect Failed", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                MessageBox.Show(ex.Message);
                return false;
            }

            finally
            {
                objConnection.Close();

            }

        }

        public DataTable ExecuteQuery(string strSQL)
        {
            DataTable objDataTable;
            SqlDataAdapter objDataAdapter;

            try
            {

                SqlConnect();
                objDataAdapter = new SqlDataAdapter();

                {

                    objDataTable = new DataTable();
                    objDataAdapter.SelectCommand = new SqlCommand(strSQL, objConnection, objTransaction);
                    objDataAdapter.Fill(objDataTable);

                    return objDataTable;
                }

            }

            catch (Exception sqlex)
            {
                throw sqlex;
            }
            finally
            {
                objDataAdapter = null;

            }
        }

        public void ExecuteNonQuery(string strSQL)
        {
            SqlCommand objSqlCommand;

            try
            {
                SqlConnect();
                objSqlCommand = new SqlCommand(strSQL, objConnection);
                objSqlCommand.Connection.Open();
                objSqlCommand.ExecuteNonQuery();
            }

            catch (SqlException ex)
            {
                throw ex;
            }
            finally
            {
                objSqlCommand = null;

            }
        }

        public bool ExecuteNonQuery(string strSQL, SqlParameter[] sqlparams)
        {

            try
            {
                int intindex;
                SqlCommand objsqlcommand = new SqlCommand(strSQL, objConnection, objTransaction);

                for (intindex = 0; intindex <= sqlparams.GetUpperBound(0); intindex++)
                {
                    objsqlcommand.Parameters.Add(sqlparams[intindex]);
                }

                objsqlcommand.ExecuteNonQuery();
                return true;
            }

            catch (Exception ex)
            {

                throw ex;

            }
        }
    }

Font F=new Font(params)

polycom123 wrote:

is there a way from C# to open the csv file and remove the first line?