Re: what is wrong here ? - C# Discussion Boards

30-Dec-04 11:38

cmd.CommandText="UPDATE CompTav SET "+
@"TeorBohen='"+RbTeorBohen.Text +"' "+
@"TechName='"+tbTech.Text +"' "+
@"TipolDate='"+dt1.ToShortDateString()+"' "+
@"TipolStartHour='"+dt2.ToShortTimeString()+"' "+
@"Statos='"+CbStatos.Text +", "+
"where CartisNum=" +lbCartisNum.Text

Heath Stewart30-Dec-04 12:06

30-Dec-04 12:06

Where do I begin? First of all, why are you using the literal string operator @? The way you're using it doesn't add anything to your statements because they only matter at compile time and will not automatically escape what you have in your text boxes, etc. They simply mean that when the source is compiled the string at that point will not expand escape sequences and can span lines until terminating with another double-quote.

Second, NEVER use string concatentation to build SQL queries. All someone has to do is insert the following into one of your text boxes and you're 0wned:

2 or 1=1; delete from CompTax --

Now you're CompTav table is gone. Worse can happen, and don't think people won't figure it out because disassemblers and decompilers are readily available and obfuscation helps little for seasoned pros. ildasm.exe - a disassembler - even comes with the .NET Framework SDK.

Also use parameterized queries:

cmd.CommandText = @"UPDATE CompTax SET
TeorBohen = @TeorBohen,
TechName = @TechName,
TipolDate = @TipolDate,
TipolStartHouse = @TipolStartHour,
Statos = @Statos
WHERE CartisNum = @CartisNum";
cmd.Parameters.Add("@TeorBohen", SqlDbType.NVarChar, 40).Value =RbTeorBohen.Text;
cmd.Parameters.Add("@TechName", SqlDbType.NVarChar, 128).Value = tbTech.Text;
cmd.Parameters.Add("@TipolDate", SqlDbType.DateTime).Value = dt1;
// ... on and on ...
try
{
  conn.Open();
  cmd.ExecuteNonQuery();
}
finally
{
  conn.Close();
}

Notice how we even assign the appropriate types to the parameters? Not only does using parameters strengthen your security (this eliminates most - if not all - SQL injection attacks) but makes it easier to execute commands. You don't have to worry about encoding your commands anymore like you do with ASP, PHP, etc. This makes batch updates a breeze, too: add the parameters once, then loop through your values setting each parameter, executing the command, then repeating.

EDIT: The above parameter syntax is for SQL Server. Oracle uses ":name" and the OLE DB provider uses only "?" (unnamed; you have to add the OleDbParameters in order of how "?"'s are declared in the SQL expression). Read about the variable IDbCommand implementations like SqlCommand, OleDbCommand, etc., and their respective Parameters properties, for more information.

This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles] [My Blog]

kings_130-Dec-04 19:46

30-Dec-04 19:46

the sample didint work
i am on a OleDB database
but thanks anywey .....

if u can help i will be greatful...

Heath Stewart30-Dec-04 20:01

30-Dec-04 20:01

I said you need to read the documentation, and that the OLE DB provider (as in the OleDbCommand) doesn't support named parameters. You must use "?" in place of the values (without any quotes or other special characters) and then add the parameters in the order they should be. If you read the documentation[^] for the OleDbCommand.Parameters is clearly explains and details this in an example.

This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles] [My Blog]

kings_131-Dec-04 0:59

31-Dec-04 0:59

i try that :
IDbCommand cmd = this.oleDbConnection2.CreateCommand();
cmd.CommandText = "UPDATE CompTav SET TeorBohen = ?, WHERE (CartisNum = ?)";

OleDbParameter parm = new OleDbParameter();
parm.ParameterName="@TeorBohen";
parm.Value = RbTeorBohen.Text;
cmd.Parameters.Add(parm);

OleDbParameter parm1 = new OleDbParameter();
parm1.ParameterName="@CartisNum";
parm1.Value = lbCartisNum.Text;
cmd.Parameters.Add(parm1);

oleDbConnection2.Open();
cmd.ExecuteNonQuery();
oleDbConnection2.Close();

but it still dont work ...

Heath Stewart31-Dec-04 6:10

31-Dec-04 6:10

Because you didn't set the type for parm1, most likely. You need to assign the values using the appropriate type, which means you need to convert lbCartisNum.Text to an integer value.

It's hard to tell, though. It does work, though: thousands of people use it every day. You didn't post the exception being thrown, so how can I know exactly what's wrong? You need to be more specific about your problems, like posting the exception message and type (like System.Data.OleDb.OleDbException and that it returned "couldn't cast to the appropriate type", or something like that).

The following may work - but again this is without knowing what your actually problem is since you didn't tell me:

cmd.Parameters.Add("@TeorBohen", OleDbType.VarChar, 80).Value = RbTeorBohen.Text;
cmd.Parameters.Add("@CartisNum", OleDbType.Integer).Value = int.Parse(lbCartisNum.Text);

Since you assigned text to parm1.Value then the value would've been quoted in the resultant command before being executed, meaning that it wasn't representing a number but instead a string containing the number.

This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles] [My Blog]

kings_131-Dec-04 7:15

31-Dec-04 7:15

i all send u the file on Mail...

Heath Stewart31-Dec-04 8:05

Re: Hidden Window Screenshot

31-Dec-04 8:05

What good would that do? I don't have your database, nor do I want it over email.

Read the documentation for the OleDbCommand.Parameters property and the OleDbParameter class for information and examples. So long as your SQL expression is right in terms of what your database is expecting, what I told you and what the documentation covers solves your problem.

If you're getting an exception that seems to indicate something else, then reply with the exception type and message - the same thing I tell everyone when they simply say something like "it doesn't work". The other regular responders would do the same. How could we know the problem unless it's painfully obvious? You need to tell us the exact error or helping you is difficult.

This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles] [My Blog]

Hidden Window Screenshot

eggie530-Dec-04 10:21

eggie5

30-Dec-04 10:21

I have some code to take a screenshot of a window, it takes it's handle as a parameter. How can I make my code take a screenshot of a hidden, or covered window? Is it even possible?

/\ |_ E X E GG

Heath Stewart30-Dec-04 11:53

Re: Hidden Window Screenshot

30-Dec-04 11:53

When get down to it, a window can never be hidden (this isn't necessarily true with layered windows, however) - it's simply not drawn. The window manager doesn't draw portions of windows - or windows in their entirety - if they are obscured. So - to answer your question - it is not possible to take screenshots of hidden windows because they're simply not painted. The screenshot code is, after all, asking GDI or GDI+ to paint into a compatible DC for a bitmap instead of a screen, printer, or other display device.

This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles] [My Blog]

eggie530-Dec-04 16:40

eggie5

30-Dec-04 16:40

Ok, then. Um, is there any way to get the image of a non-visable window???

/\ |_ E X E GG

Re: Hidden Window Screenshot

Heath Stewart30-Dec-04 19:51

generate a random number of the bignumber

30-Dec-04 19:51

I think you missed my point: hidden windows are not drawn to any device context (DC), which means you can't get an "image" of them - they're not drawn.

If you want a simple one-word answer to your original question, then "no".

This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles] [My Blog]

asmyan30-Dec-04 9:18

asmyan

30-Dec-04 9:18

hello
i want to generate the random number for the bignumber by using the bignumbers class. how to do it?

Re: generate a random number of the bignumber

Heath Stewart30-Dec-04 9:45

Re: regarding dundas evaluation version

30-Dec-04 9:45

Read the article for the BigInteger class I gave you earlier. The guy created it specifically for RNGs for encryption. If you have questions about the article the the BigInteger class itself, ask in the message board at the bottom of the article - that's what it's there for. This forum is for general C# questions and questions about .NET development with C# that are covered under other forums (like the ASP.NET or ADO.NET forums), don't include article content, and aren't third-party controls (like you asked about in your previous question regarding Dundas).

BTW, you should know Dundas is a major supporter of this site. You shouldn't be announcing that you're trying to crack their product.

This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles] [My Blog]

Heath Stewart30-Dec-04 9:14

Sorry for asking such a question

30-Dec-04 9:14

This is a third-party control and is not supported by this forum, nor should it be since removing the Watermark in an evaluation version is wrong and most likely illegal (based on whatever the EULA that you agreed to says).

If you need help with third-party controls or applications you should consult the manufacturer/developer.

This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles] [My Blog]

asmyan30-Dec-04 17:29

asmyan

30-Dec-04 17:29

hello
I am really very sorry for asking such a non-professional question. I dont want to ask it in this manner as i only required a control which i can use freely. I am again very sorry.

regards
asmyan

Re: Sorry for asking such a question

Heath Stewart30-Dec-04 19:53