C#

public void Fetch()
{
    database.Query("SELECT * FROM ws_cart_product WHERE cart_id=?cart_id;");
    database.Add("?cart_id", cart_id);

    foreach (DataRow row in database.FetchAsDataTable().Rows)
    {
        cart_id = global.ParseInt(row["cart_id"].ToString());
        if (row["product_id"] != DBNull.Value)
        {
            product_id = global.ParseInt(row["product_id"].ToString());
        }
        if (row["parent_id"] != DBNull.Value)
        {
            parent_id = global.ParseInt(row["parent_id"].ToString());
        }
        if (row["quantity"] != DBNull.Value)
        {
            quantity = global.ParseInt(row["quantity"].ToString());
        }

// Here I try to combine them
        Product product = new Product();
        product.product_id = global.ParseInt(row["product_id"].ToString());
        product.Fetch();
    }
}

public void Fetch()
{
    StringBuilder query = new StringBuilder();
    query.Append("SELECT *,  ");
    query.Append("(");
    query.Append("SELECT thumbnail ");
    query.Append("FROM ws_product_file, file ");
    query.Append("WHERE file.file_id=ws_product_file.file_id ");
    query.Append("AND ws_product_file.product_id=ws_product.product_id ");
    query.Append("AND file.status_id=1 ");
    query.Append("ORDER BY sortorder DESC LIMIT 0,1");
    query.Append(") ");
    query.Append("AS thumbnail,  ");
    query.Append("(");
    query.Append("SELECT mimetype ");
    query.Append("FROM ws_product_file, file ");
    query.Append("WHERE file.file_id=ws_product_file.file_id ");
    query.Append("AND ws_product_file.product_id=ws_product.product_id ");
    query.Append("AND file.status_id=1 ");
    query.Append("ORDER BY sortorder DESC LIMIT 0,1");
    query.Append(") ");
    query.Append("AS mimetype ");
    query.Append("FROM webpage, ws_product ");
    query.Append("WHERE webpage.status_id=1  ");
    query.Append("AND webpage.webpage_type_id=4 ");
    query.Append("AND ws_product.product_id=webpage.webpage_type_content_id ");
    query.Append("AND ws_product.product_id=?product_id; ");
    database.Query(query.ToString());
    database.Add("?product_id", product_id);

    foreach (DataRow row in database.FetchAsDataTable().Rows)
    {
        product_id = global.ParseInt(row["product_id"].ToString());
        if (row["parent_id"] != DBNull.Value)
        {
            parent_id = global.ParseInt(row["parent_id"].ToString());
        }
        if (row["status_id"] != DBNull.Value)
        {
            status_id = global.ParseInt(row["status_id"].ToString());
        }
        if (row["create_date"] != DBNull.Value)
        {
            create_date = global.ParseDateTime(row["create_date"].ToString());
        }
        if (row["product_no"] != DBNull.Value)
        {
} 
// There is more...
}
}

{Dotcontent.CartProduct}

  cart_id: 1
  product_id: 64
  parent_id: 0
  quantity: 2
  customer_id: 0
  guid: null


{Dotcontent.Product}

  webpage_id: 145
  website_id: 0
  status_id: 1
  url: "mode360-composer-fotostudio-fa40"
  type: null
  webpage_type_id: 0
  webpage_type_content_id: 0
  version: 0
  language_id: 0
  parent_id: 0
  related_webpage_id: 0
  title: "Mode360 Composer Fotostudio FA40"
  text: null
  short_description: null
  meta_description: null
  published_from: 1-1-0001
  published_to: 1-1-0001
  created_on: 1-1-0001
  created_by: 0
  product_id: 64
  create_date: 16-9-2016
  product_no: "291610"
  ean: ""
  price_on_request: False
  weight: 0
  brand_id: 0
  in_export: False
  template_id: 1
  mimetype: "image/jpeg"
  thumbnail: "iVBORw0KGg
  price: 0
  old_price: 0
  label: "Tijdelijke aanbieding"
  quantity: 0

CartProduct cart = new CartProduct();
       cart.cart_id = 1;
       cart.Fetch();

       Response.Write("<pre>" + ObjectDumper.Dump(cart) + "</pre>");


       Product product  = new Product();
       product.product_id = cart.product_id;
       product.Fetch();

       Response.Write("<pre>" + ObjectDumper.Dump(product) + "</pre>");

I need to design class library for sql injection prevention by using ASP.NET with C# When the application server received input from the user, it dynamically generated the query based on the input. This query, along with the developer-intended query made use of keyword randomization, where the randomly generated key was appended to the SQL keywords in both queries. These queries were then forwarded to an XML parsing component, which converted both queries into XML trees. and comparing the corresponding nodes in these sub-stacks by using multiple threads, and based on the result of comparison, the algorithm was able to determine whether the dynamically built query was an attack or not. If this query was non-malicious, it was allowed to pass further to the database server for execution. However, if the algorithm determined a query as an attack, it was blocked at the application server and was not sent to the database server for execution. The attack queries were added to an error log to help the system administrators to My Email : [DELETED]@gmail.com

public bool PushToDatabase(DataCollection data)
{
 try
 {
  // insert data in database
  PerformDatabaseInsert(data);
  // then update the visual
  App.Current.Dispatcher.Invoke(new Action(() => lst_MyData.ItemsSource = data.ToArray()));
  return true;
 }
 catch (Exception ex)
 {
  // Display error to user
  return false;
 }
}

private void btn_Submit_Click(object sender, RoutedEventArgs e)
{
 if (InputsAreGood())
 {
  DataCollection data = GetFormFields();

  Thread thread = new Thread(() =>
  {
   MainWindow.SetCursor_Wait(); // visual candy via the Dispatcher

   if (PushToDatabase(data))
   {
    ClosePopOutControl();
   }

   MainWindow.SetCursor_Arrow();
  });

  thread.Start();
 }
 else
 {
  // inform user what they missed
 }
}

public async Task UpdateListViewAsync(DataCollection data)
{
 // Dispatcher is awaitable, so no problems here
 await Dispatcher.Invoke(() =>
 {
  // but you cannot await a void so I have to rewrite it to this
  return Task.Run(() => { lst_MyData.ItemsSource = data.ToArray(); });
 }
}

public async Task<bool> PushToDatabaseAsync(DataCollection data)
{
 Task<bool> dataPushTask = Task.Run(() => PushToDatabase(data));
 bool result = await dataPushTask;
 await UpdateListViewAsync();
 return result;
}

private btn_Submit_Click(object sender, RoutedEventArgs e)
{
 bool taskResult;

 try
 {
  MainWindow.SetCursor_Wait();

  if (InputsAreGood())
  {
   DataCollection data = GetFormFields():

   Func<Task<bool>> dataPushLambda = async () => await PushToDatabaseAsync(data); 
   taskResult = await App.Current.Dispatcher.InvokeAsync(dataPushLambda).Result;

   if (taskResult)
   {
    ClosePopOutForm();
   }
   else
   {
    // tell user that something went wrong
   } 
  }
  else
  {
   // tell user what fields they missed
  }
 }
 catch (Exception ex)
 {
  // display the error to the user
 }
 finally
 {
  MainWindow.SetCusor_Arrow();
 }
}

Func<Task<bool>> dataPushLambda = async () => await PushToDatabaseAsync(data); 
taskResult = await App.Current.Dispatcher.InvokeAsync(dataPushLambda).Result;

taskResult = await App.Current.Dispatcher.InvokeAsync(dataPushLambda).Result;
// and
taskResult = await await App.Current.Dispatcher.InvokeAsync(dataPushLambda);