|
cmd.CommandText="UPDATE CompTav SET "+
@"TeorBohen='"+RbTeorBohen.Text +"' "+
@"TechName='"+tbTech.Text +"' "+
@"TipolDate='"+dt1.ToShortDateString()+"' "+
@"TipolStartHour='"+dt2.ToShortTimeString()+"' "+
@"Statos='"+CbStatos.Text +", "+
"where CartisNum=" +lbCartisNum.Text
|
|
|
|
|
Where do I begin? First of all, why are you using the literal string operator @? The way you're using it doesn't add anything to your statements because they only matter at compile time and will not automatically escape what you have in your text boxes, etc. They simply mean that when the source is compiled the string at that point will not expand escape sequences and can span lines until terminating with another double-quote.
Second, NEVER use string concatentation to build SQL queries. All someone has to do is insert the following into one of your text boxes and you're 0wned:
2 or 1=1; delete from CompTax -- Now you're CompTav table is gone. Worse can happen, and don't think people won't figure it out because disassemblers and decompilers are readily available and obfuscation helps little for seasoned pros. ildasm.exe - a disassembler - even comes with the .NET Framework SDK.
Also use parameterized queries:
cmd.CommandText = @"UPDATE CompTax SET
TeorBohen = @TeorBohen,
TechName = @TechName,
TipolDate = @TipolDate,
TipolStartHouse = @TipolStartHour,
Statos = @Statos
WHERE CartisNum = @CartisNum";
cmd.Parameters.Add("@TeorBohen", SqlDbType.NVarChar, 40).Value =RbTeorBohen.Text;
cmd.Parameters.Add("@TechName", SqlDbType.NVarChar, 128).Value = tbTech.Text;
cmd.Parameters.Add("@TipolDate", SqlDbType.DateTime).Value = dt1;
try
{
conn.Open();
cmd.ExecuteNonQuery();
}
finally
{
conn.Close();
}Notice how we even assign the appropriate types to the parameters? Not only does using parameters strengthen your security (this eliminates most - if not all - SQL injection attacks) but makes it easier to execute commands. You don't have to worry about encoding your commands anymore like you do with ASP, PHP, etc. This makes batch updates a breeze, too: add the parameters once, then loop through your values setting each parameter, executing the command, then repeating.
EDIT: The above parameter syntax is for SQL Server. Oracle uses ":name" and the OLE DB provider uses only "?" (unnamed; you have to add the OleDbParameters in order of how "?"'s are declared in the SQL expression). Read about the variable IDbCommand implementations like SqlCommand, OleDbCommand, etc., and their respective Parameters properties, for more information.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
the sample didint work
i am on a OleDB database
but thanks anywey .....
if u can help i will be greatful...
|
|
|
|
|
I said you need to read the documentation, and that the OLE DB provider (as in the OleDbCommand) doesn't support named parameters. You must use "?" in place of the values (without any quotes or other special characters) and then add the parameters in the order they should be. If you read the documentation[^] for the OleDbCommand.Parameters is clearly explains and details this in an example.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
i try that :
IDbCommand cmd = this.oleDbConnection2.CreateCommand();
cmd.CommandText = "UPDATE CompTav SET TeorBohen = ?, WHERE (CartisNum = ?)";
OleDbParameter parm = new OleDbParameter();
parm.ParameterName="@TeorBohen";
parm.Value = RbTeorBohen.Text;
cmd.Parameters.Add(parm);
OleDbParameter parm1 = new OleDbParameter();
parm1.ParameterName="@CartisNum";
parm1.Value = lbCartisNum.Text;
cmd.Parameters.Add(parm1);
oleDbConnection2.Open();
cmd.ExecuteNonQuery();
oleDbConnection2.Close();
but it still dont work ...
|
|
|
|
|
Because you didn't set the type for parm1, most likely. You need to assign the values using the appropriate type, which means you need to convert lbCartisNum.Text to an integer value.
It's hard to tell, though. It does work, though: thousands of people use it every day. You didn't post the exception being thrown, so how can I know exactly what's wrong? You need to be more specific about your problems, like posting the exception message and type (like System.Data.OleDb.OleDbException and that it returned "couldn't cast to the appropriate type", or something like that).
The following may work - but again this is without knowing what your actually problem is since you didn't tell me:
cmd.Parameters.Add("@TeorBohen", OleDbType.VarChar, 80).Value = RbTeorBohen.Text;
cmd.Parameters.Add("@CartisNum", OleDbType.Integer).Value = int.Parse(lbCartisNum.Text);Since you assigned text to parm1.Value then the value would've been quoted in the resultant command before being executed, meaning that it wasn't representing a number but instead a string containing the number.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
i all send u the file on Mail...
|
|
|
|
|
What good would that do? I don't have your database, nor do I want it over email.
Read the documentation for the OleDbCommand.Parameters property and the OleDbParameter class for information and examples. So long as your SQL expression is right in terms of what your database is expecting, what I told you and what the documentation covers solves your problem.
If you're getting an exception that seems to indicate something else, then reply with the exception type and message - the same thing I tell everyone when they simply say something like "it doesn't work". The other regular responders would do the same. How could we know the problem unless it's painfully obvious? You need to tell us the exact error or helping you is difficult.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
I have some code to take a screenshot of a window, it takes it's handle as a parameter. How can I make my code take a screenshot of a hidden, or covered window? Is it even possible?
/\ |_ E X E GG
|
|
|
|
|
When get down to it, a window can never be hidden (this isn't necessarily true with layered windows, however) - it's simply not drawn. The window manager doesn't draw portions of windows - or windows in their entirety - if they are obscured. So - to answer your question - it is not possible to take screenshots of hidden windows because they're simply not painted. The screenshot code is, after all, asking GDI or GDI+ to paint into a compatible DC for a bitmap instead of a screen, printer, or other display device.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
Ok, then. Um, is there any way to get the image of a non-visable window???
/\ |_ E X E GG
|
|
|
|
|
I think you missed my point: hidden windows are not drawn to any device context (DC), which means you can't get an "image" of them - they're not drawn.
If you want a simple one-word answer to your original question, then "no".
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
hello
i want to generate the random number for the bignumber by using the bignumbers class. how to do it?
|
|
|
|
|
Read the article for the BigInteger class I gave you earlier. The guy created it specifically for RNGs for encryption. If you have questions about the article the the BigInteger class itself, ask in the message board at the bottom of the article - that's what it's there for. This forum is for general C# questions and questions about .NET development with C# that are covered under other forums (like the ASP.NET or ADO.NET forums), don't include article content, and aren't third-party controls (like you asked about in your previous question regarding Dundas).
BTW, you should know Dundas is a major supporter of this site. You shouldn't be announcing that you're trying to crack their product.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
This is a third-party control and is not supported by this forum, nor should it be since removing the Watermark in an evaluation version is wrong and most likely illegal (based on whatever the EULA that you agreed to says).
If you need help with third-party controls or applications you should consult the manufacturer/developer.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
hello
I am really very sorry for asking such a non-professional question. I dont want to ask it in this manner as i only required a control which i can use freely. I am again very sorry.
regards
asmyan
|
|
|
|
|
It's an evaluation version, as you clearly stated. That implies it is not free, and I think you knew that, too, since you were trying to crack it and get rid of the watermark.
If you want to know how to make your own charting control, then search or browse the articles on this site. I've seen several that cover the basics of charting (with a decent amount of math know-how and knowledge about owner drawing controls, it's actually quite easy).
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
|
Hi,
I created a simple application in C# using .NET visual studio. The release build seems to work just fine on my development machine but it does NOT seem to work on my "non-development" machine (a clean W2k machine with no visual studio .net). By the way, I was using the default release build setting to create the exe.
I get error complains such as "mscoree.dll is missing". When I provide this mscoree.dll it cries about some registry key not setup to point to the install path etc. etc.
Any idea, suggestion, help?
Thanks!
|
|
|
|
|
|
And poeple think that only VBers ask the dumb questions... 
Seriously though... I can't count the number of times this gets asked all over the place...
Paul Watson wrote:
"At the end of the day it is what you produce that counts, not how many doctorates you have on the wall."
George Carlin wrote:
"Don't sweat the petty things, and don't pet the sweaty things."
Jörgen Sigvardsson wrote:
If the physicists find a universal theory describing the laws of universe, I'm sure the a**hole constant will be an integral part of that theory.
|
|
|
|
|
They should rename the DLL from "mscoree.dll" to something like "Please install the .NET Framework Redirstributable.dll" so error messages like "mscoree.dll is missing" sound more understandable to the users
--
Affordable Windows-based CMS: www.zeta-producer.com
|
|
|
|
|
|
I'm a beginer in WebServices. I need to interact my WebService with
a DataBase and the clients of the WebService. Because I'm the
administrator of DB I need to send to WebClients, of the WebService,
updated information on tables, datasets ... For this i need to known
from my WebService Witch clients are connected at some time.
How can i update clients information without they hask for none?
thank's.
Bruno Conde. 
|
|
|
|
|
There are many articles covering web services, here on CP and on MSDN. Check out the articles posted here[^] on web services written in C#.
- Nick Parker
My Blog | My Articles
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
