|
Joshua Boyle wrote: I took that string directly from a tutorial on the web
Then who ever posted it should be shot! Apart from anything else it suffers from a severe susceptability from a SQL Injection Attack. Here's an article that provides a description of what a SQL Injection Attack is, how to spot code that is susceptable and what you can do to make the code safer[^]
You should use a parameterised query instead
Your string becomes:
"INSERT INFO Guestbook (Planner, Location, Time, Date) VALUES(?,?,?,?)"
And you can add the parameters like this:
myCommand.Parameters.Add("", txtHistoryPlanner.Text) ' etc.
Probably what is giving you an error is if one of the text boxes contains something that the SQL parser is misinterpreting. For example, if some piece of text contains an apostrophe the SQL parser will interpret that as the end of string and then get confused when the string continues.
|
|
|
|
|
Thank you for the response. I used your string exactly (changing "INFO" to "INTO" only and inserting my own data and this is what it looks like:
strSQL = "INSERT INTO tblEvents (Planner, Name, Date, Time, Location, Description, Attendees) VALUES(?,?,?,?,?,?,?)"
Then I create all my parameters as follows:
<br />
oleParams(0) = New OleDbParameter("Planner", cboEventPlanner.Text)<br />
oleParams(1) = New OleDbParameter("Name", txtName.Text)<br />
oleParams(2) = New OleDbParameter("Date", dtpDate.Text)<br />
oleParams(3) = New OleDbParameter("Time", txtTime.Text)<br />
oleParams(4) = New OleDbParameter("Location", txtLocation.Text)<br />
oleParams(5) = New OleDbParameter("Description", txtDescription.Text)<br />
oleParams(6) = New OleDbParameter("Attendees", strAttendees)<br />
Finally, I add the parameters as follows:
oleCommand.Parameters.AddRange(oleParams)
I have tried every kind of arrangement of the strSQL string. Additionally, I have tried adding each parameter individually instead of as a range. I even explicity declared 7 oleDbParamter objects and stuffed each one with the respective parameters. No matter what I do, it gives me the following error when the Submit button on my form is clicked:
Syntax error in INSERT INTO statement.
Any ideas what I'm doing wrong here? I'm at a complete loss.
-- modified at 9:58 Tuesday 25th July, 2006
|
|
|
|
|
FOR THE LOVE OF ALL THAT IS SACRED
I honestly feel like spooning my own eyes out with a dull pencil at present.
As it turns out, the issue was never the actual syntax, per sé, of the SQL statement but rather the usage of field names such as: "Name", "Date" and "Time". These three, for example, happen to be reserved keywords within MS Access so when I sent the statement:
strSQL = "INSERT INTO tblEvents (Planner, Name, Date, Time, Location, Description, Attendees) VALUES(?,?,?,?,?,?,?)"
Access was hiccuping on those three because it didn't know what the hell to do with them.
/sigh
Anyway, the problem was solved by simply renaming all my fields in the database by prefixing each one with a 'p' for "parameter". The program works fine now.
/me grabs a dull pencil
/me waves
|
|
|
|
|
I believe* you can also escape reserved words when they are used as column names by enclosing the column name in square brackets. e.g. [Name]
I'm primarily a SQL Server person.
|
|
|
|
|
Hi
Yes you are right... same thing applies for when the field name has a space in it. eg., [Student Id]
Chandra
|
|
|
|
|
I'm trying to use a data reader to add items to an arraylist
I've tried several approaches - my code always reads the database correctly
( I can see the values it finds) but then I get an exception saying
Object reference not set to an instance of an object.
My original ideas were something like this:
Dim IdNums as arraylist
Dim command As OleDbCommand = con.CreateCommand()
command.CommandText = "SELECT Id from Candidates "
Dim reader As IDataReader = command.ExecuteReader
While (reader.Read())
m_ID = reader("id")
IdNums.Add(m_ID)
End while
OR
Dim IDNums as arraylist
Dim command As OleDbCommand = con.CreateCommand()
command.CommandText = "SELECT Id from Candidates "
Dim reader As IDataReader = command.ExecuteReader
Dim i As Integer = 0
While (reader.Read())
IdNums.Add(reader.GetValue(i))
End while
I thought the error message meant I had to create an object so I tried
Dim IDNums as arraylist
Dim command As OleDbCommand = con.CreateCommand()
command.CommandText = "SELECT Id from Candidates "
Dim reader As IDataReader = command.ExecuteReader
Dim IDobj As string = " "
While (reader.Read())
IdNums.Add(IDobj)
End while
but same results
Any thoughts
Thanks
|
|
|
|
|
ssbelfast wrote: Dim IDNums as arraylist
Try using the "New" keyword as in
Dim IDNums as New ArrayList.
|
|
|
|
|
|
I am trying to work my way into vb.net and classes. However right now I am locked into VB6 but can start using classes.
I can access "NewExam.Sections(3).Items(4).Name" using the followng code:
Type udtItem
ItemNum As Integer
Locked As Boolean
Name As String
End Type
Type udtSection
Items() As udtItem
End Type
Type udtExam
Sections() As udtSection
End Type
Dim NewExam As udtExam
Is there a easy way to do the same thing with classes without having to create 3 or more seperate classes.
|
|
|
|
|
After 10 or 20 minutes, my ASPX website loses the Global Variables defined in GLOBAL.asax The following is in Global.asax which has been designated as readonly file.
<script language="VB" runat="Server">
Public Class GlobalVarDefinitions
Public GlobalVars As Object
Public Company As String
End Class
Sub Session_Start(ByVal sender As Object, ByVal e As EventArgs)
Dim GlobalVars As New GlobalVarDefinitions
Session("Globals") = GlobalVars
Session("Globals").Company = "89"
Session("Globals").CompanyName = "Walong"
End Sub
</script>
In the individual aspx programs, the Global Variables are reference like this:
ICompany = Session("Globals").Company
In HTML as: <%=Session("Globals").CompanyName%>
How can I stop losing my Global Session Variables?????
|
|
|
|
|
Please check the session time out period. In your webconfig file look into SessionState property and look for timeout atribute. This attribute decides the timeout period for your session.
Mandar Patankar
Microsoft Certified professional
|
|
|
|
|
Thanks, Also, appparently the IIS Session Time-out overrides the webconfig file Time-out setting.
I found this on the website below:
<configuration>
<system.web>
<sessionState
mode="Inproc"
cookieless="true"
timeout="20" />
</sessionState>
</system.web>
</configuration>
This shows the values you need in the <sessionState code in the webconfig file. Reference: http://authors.aspalliance.com/aspxtreme/aspnet/syntax/sessionstatesection.aspx (cut and paste this URL in your Browser, this page explains all the appropriate values.)
By the way, my origianl code Session Variables work great, they are just timing out. So, if this is the solution, I have a solid, nicely working internal website.
|
|
|
|
|
I am doing an Excel VB, to make a Power Point Report, but now they ask me to create the report and create an HTML document to publish over the intranet, I've tryed the SaveAs function, but It didn't give me a HTML file, but it gave me the Power Point report.
following are the last rows of code:
:
:
:
Sheet1.Activate
ppApp.ActivePresentation.SaveAs Filename:="c:\ToPublish.htm", FileFormat:=ppSaveAsHTML, EmbedTrueTypeFonts:=msoFalse
ppApp.ActivePresentation.SaveAs Filename:= "c:\Followup.ppt"
' Clean up
ppApp.Quit
Set PPSlide = Nothing
Set PPPres = Nothing
Set ppApp = Nothing
'ppApp.Close
Sheet1.Activate
ActiveSheet.Range("d7").Select
Application.StatusBar = False
Application.ScreenUpdating = True
End Sub
Can anyone help me? 
Kind Regards.
|
|
|
|
|
I posted a question regarding how to (re)fill a dataset, but got no replies. Is there a tutorial on datasets and tableadapters that someone could refer me to?
thanks
|
|
|
|
|
I replied. Today. A little patience goes a long way. 
I may be able to help you.
|
|
|
|
|
hi..cstrader232 (how to spell your name?) 
It's not easy to make tutorial. if i got ones i will inform you..
But let take a look in your problem.. what are the problem regarding to fill or refill dataset and also with table adapter. ?
just let us know ur problem then we can respon it as soon as we understand and figure out the solution.
Beside, you have to try by yourself to experience more problem and that will make you sharper.
How about interactive tutorial..?
we'll discuss what kind of project will be develop in order to learn something within. and then we can develop it together in paralel?
:-Ois it sound good?
|
|
|
|
|
I could not find the category of crystal reports forum so I am posting here.
I want to declare global variable in formula editor and access that variable in another formula editor in the same report. How can I do that? Please help.
|
|
|
|
|
assuming that the opening bal is printed on the report header section & the
transaction in the detail section
if the opening balance is debit, then each balance should be calculated
as opbal+ddd-ccc and then the balance after first transaction
will get. then the next balance will be calculated as first
balance + debit - credit and the third balance should be
calculated as second balance + debit - credit.
you can create 2 formulas
1- init - pasted on the report footer besides opening bal
shared currencyvar runbal:= 0
runbal:=openbal;
runbal
2. baltot -pasted on the detail section
shared currencyvar runbal;
runbal:=runbal+debit - credit;
runbal
Thanks & Regards
Senthil
|
|
|
|
|
hi to all,
i m working on a project in which i got stucked in a problem when i m trying to connect with Sql server 2000.
I tried to connect it with sqldataadapter wizard & i get this error message
" The Specified module coulde not be found ".
can anybody tell me why this problem arises. Please reply soon. Thanx in Advance.
|
|
|
|
|
What connection string are you using?.
Mandar Patankar
Microsoft Certified professional
|
|
|
|
|
Hello all,
I am a complete NEWBIE to VB programming, I usually do everything through C++. However, I am using Word for part of a program and am adding command buttons. In the function, I am trying to simply save the document and exit Word.
Here is the code I have, but it doesn't seem to do anything.
Thanks in advance for the help....
Private Sub CommandButton1_Click()
ActiveDocument.Save
ActiveDocument.Close
Application.Quit
End Sub
|
|
|
|
|
All the objects you are creating should be closed. if you are missing any single reference to close then this code will not work. Second thing go to Articles in Code Project and search For Word you will found many solutions
-- modified at 3:58 Tuesday 25th July, 2006
|
|
|
|
|
Hi,
Would like to apply colors (BG Color, FG color & Font Color) of selected windows ColorScheme for windows controls.
currently using the following code
Imports Microsoft.Win32 <br />
<br />
Dim SchemeKey As RegistryKey<br />
<br />
SchemeKey = Microsoft.Win32.Registry.CurrentUser.OpenSubKey("Control Panel").OpenSubKey("Appearance").OpenSubKey("Schemes")
This will return the Scheme values…..e.g. Brick, Arizona etc….
I would like to get the color values for windows controls for the selected colorscheme.
Thanks,
RK
|
|
|
|
|
Hi,
I wish to display the application's help contents(.chm format) in Infragistics' Taskpane control using HelpProvider component.
Any help would be appreciated.
RK
|
|
|
|
|
Ask them. They sold it to you so they should solve your problems... and they can do this probably better than anyone here.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
