C# Discussion Boards - CodeProject

3-Jan-12 7:39

hi
i designed my form as

textbox, button

now in the buttonclick event i wrote a code which is as follows!

try
{
string constr = "User Id = scott;Password=tiger;Provider=Msdaora.1";
OleDbConnection con = new OleDbConnection(constr);
con.Open();
MessageBox.Show(" Connected to ORACLE!");
string q = "create table pert(enum number,ename varchar2(10),sal number)";
OleDbCommand cmd = new OleDbCommand(q, con);
cmd.ExecuteNonQuery();
MessageBox.Show("Table Created!");

}
catch (OleDbException a)
{
MessageBox.Show(a.Message);
}
now in the string q how do i add a textbox1.text so that while running my program i give the table name dynamically instead of statistically mentioning the table name as shown in the string q.

PIEBALDconsult3-Jan-12 7:43

PIEBALDconsult

3-Jan-12 7:43

Perhaps with a parameter (I haven't tried it); certainly with concatenation, but that would be bad form.

mpvkrishnadhar3-Jan-12 7:46

3-Jan-12 7:46

was that an anwswer! its looking like something else!

Luc Pattyn3-Jan-12 8:05

3-Jan-12 8:05

with precautions, no bad form I'd say.

Smile | :)

Luc Pattyn [My Articles] Nil Volentibus Arduum

Luc Pattyn3-Jan-12 8:04

3-Jan-12 8:04

IMO the answer holds two parts:

1. don't use a TextBox, use a ComboBox (with ComboBoxStyle.DropDownList) presenting the allowable table names.
2. then perform string concatenation to build the SQL statement.

Smile | :)

Luc Pattyn [My Articles] Nil Volentibus Arduum

AHSAN1114-Jan-12 4:38

4-Jan-12 4:38

the dropdown list would eliminate the facility of having tablenames according to user choices. This IMO is essential if we are dealing with a SQL Parser or a simillar application, or a situation where we need user-specified entity names in the database.

We can use a textbox and employ reguler expressions / validation controls in order to eliminate the possibility of an incorrect tablename.

Luc Pattyn4-Jan-12 4:49

4-Jan-12 4:49

Something needs to be done to protect against abuse. Validation is one way, yes.

Smile | :)

Luc Pattyn [My Articles] Nil Volentibus Arduum

AHSAN1113-Jan-12 22:02

3-Jan-12 22:02

Try the following:

string q = "create table " + Textbox1.text + "(enum number,ename varchar2(10),sal number)";

a better way (cleaner and easily readable) of doing it would be to use a local string variable to store the table name from the text box and concatenate the string using that variable.

string temp = Textbox1.Text;
string q = "create table "+temp+ " (enum number,ename varchar2(10),sal number)";

Luc Pattyn4-Jan-12 3:14

4-Jan-12 3:14

Luc Pattyn [My Articles] Nil Volentibus Arduum

AHSAN1114-Jan-12 4:31

4-Jan-12 4:31

why did u downvote ?? please explain Smile | :)

Luc Pattyn4-Jan-12 4:41

4-Jan-12 4:41

I disliked very much however I did not downvote.
Your code would not compile.
And it is flawed, see my other posts in this thread.

Hmmm | :|

Luc Pattyn [My Articles] Nil Volentibus Arduum

mpvkrishnadhar4-Jan-12 4:23

4-Jan-12 4:23

hi
AHSAN111!

thanks for the reply mate! the first and the second parts that u explained are working fine for me!

this is how my new code looks like!

try
{
string constr = "User Id = scott;Password=tiger;Provider=Msdaora.1";
OleDbConnection con = new OleDbConnection(constr);
con.Open();
MessageBox.Show(" Connected to ORACLE!");
string g = textBox1.Text;
string q = "create table " +g+ "(enum number,ename varchar2(10),sal number)";
OleDbCommand cmd = new OleDbCommand(q, con);
cmd.ExecuteNonQuery();
MessageBox.Show("Table Created!");
}

Luc Pattyn4-Jan-12 4:34

4-Jan-12 4:34

that is bad code, it is open for SQL injection, people can type anything they like in the TextBox and make your program execute it.

I already told you precautions had to be taken against it, using a uneditable ComboBox rather than a TextBox is one way of doing just that.

Smile | :)

Luc Pattyn [My Articles] Nil Volentibus Arduum

mpvkrishnadhar4-Jan-12 4:53

4-Jan-12 4:53

ooh!

but if i use comboboxstyle with allowable table names! the whole purpose of what i wanted would not be served! is there any way by which it can be done! ? but thank u very much for the suggestion mate! am seriously learning a lot from this!

AHSAN1115-Jan-12 2:18