|
I take it there is a question buried in this somewhere...?
Dave Kreskowiak
Microsoft MVP - Visual Basic
|
|
|
|
|
hai
i'm doing a project on travel & tourism in vb.net...i've written a code for user login...but it shows some error "ret = com.ExecuteScalar()" in this line...pls can any1 help me out...
Dim com As New OleDb.OleDbCommand
Dim con As OleDb.OleDbConnection
Dim ret As Integer
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
con = New OleDb.OleDbConnection("provider=microsoft.jet.oledb.4.0;data source=E:\Ishu\Ishwarya\mini proj\travels.mdb")
con.Open()
com = New OleDbCommand("select count(*) from users where User Name='" + TextBox1.Text + "' and Password='" + TextBox2.Text + "'", con)
ret = com.ExecuteScalar()
If (ret > 0) Then
Dim frmobj As frmbc
frmobj.Show()
Else
MsgBox("Invalid Username")
End If
End Sub
|
|
|
|
|
What is the error?
Cleako
|
|
|
|
|
An unhandled exception of type 'System.Data.OleDb.OleDbException' occurred in system.data.dll
this was the error...was my code right??? pls reply asap
|
|
|
|
|
Here is a very interesting question for you. What if the user typed in the following into the user name text box:
' OR 1=1;--
Answer:
select count(*) from users where UserName='' OR 1=1;--' AND Password=''
And that will return a value of however many users are in your database to ret. This then allows anyone access to your application, even if they are not permitted.
You really MUST learn about SQL Injection Attacks and some Tips on How to Prevent Them[^]
By the way, your immediate error is caused because you have a syntax error in your SQL. User Name should either not have a space, or it should be enclosed in square brakets like this [User Name].
|
|
|
|
|
Wow I didnt realize User Name was a reserved phrase, you learn something everyday!
Cleako
|
|
|
|
|
cleako wrote: I didnt realize User Name was a reserved phrase, you learn something everyday!
It isn't. But the parser will interpret it as two distinct tokens unless you put square brakets around it. It will then get confused about what the second token means.
Now, what are you going to do about your gaping security hole?
|
|
|
|
|
Colin already answered your question but Im going to have to agree with him on the straight SQL, I just didnt want to say anything. Since you are using an Access DB you are going to have to validate the input to make sure that nothing that can lead to a SQL Injection attack is entered. First rule of user interactive programming is:
"All user input is EVIL!!!!"
Cleako
|
|
|
|
|
I'm using VB.NET 2005 Express, and I am reading in the contents of a text file.
I have declared:
Dim strLine as String
I'm using the StreamReader to read the contents of the text file, and I'm putting the contents into strLine.
Unfortunately, it only seems to read in the first 16381 lines from the text file, and processes those lines without any problems - but ignores lines beyond this. All my other test files (having far fewer lines than 16381) work fine.
On this occasion, the file that I need to read is 124415 lines long and so, as a novice, I've concluded that 'String' isn't up to the job.
Can anybody point me in the right direction?
|
|
|
|
|
try to user System.Text.StringBuilder instead of string
When you get mad...THINK twice that the only advice
Tamimi - Code
|
|
|
|
|
Thanks for your reply.
I managed to solve the problem.
I had a Try ... Catch which was hiding the real problem - which was a problem with huge numbers I hadn't anticipated having to process. Simply changing the variables from Int to Long seems to have solved the problem.
|
|
|
|
|
Hi,
I have made a second form in VB.NET , now for some calculations i have to pass some parameters to the second form. How can i do this ?
//within the main form
Private Sub cmdDisplay_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles cmdDisplay.Click
Dim results As frmDisplayExpenses
results = New frmDisplayExpenses
results.ShowDialog()
End Sub
what should i do if i want to pass the param [salary] to the second created form ?
|
|
|
|
|
|
The best way is to use properties to pass stuff back and forth, but you don't have to restrict yourself to properties you define. For instance, if you want to collect a chunk of text in the second form, you can code something like this, assuming you have a text box on the second form:
<br />
Dim MyString as string<br />
Dim dlg as new FormTwo<br />
Dim result as DialogResult<br />
<br />
dlg.TextBox1.text = "Default Value"<br />
result = dlg.ShowDialog()<br />
If result = DialogResult.OK Then<br />
MyString = dlg.TextBox1.text<br />
Else<br />
' Some kind of error handling code<br />
End If<br />
JimT
|
|
|
|
|
 Hallo Friends,
Need Help
I hav deployed my vb.net(Winforms)2005 application on client m/c through setup of my application.
In application's setup i hav added merge module CrystalReports10_maps.msm.
but when i m opening my crystal report through my application on client side machine it is asking for login id & password. My database is in mysql. I m giving the userid & password tht using in my application , but it says-> Logon failed.
Application is showing other forms but asking login only for crystal report.
Please help me.
-Thanks for any help in advance.
|
|
|
|
|
Hey,
If you don't want to be prompted for database credentials when you open the crystal report you should change the database connection (in crystal, under Database > Database Expert) to use integrated security as opposed to typing in the username / password.
Later
Nathan Lindley
|
|
|
|
|
Hi,
Im using .Net 2, creating a user entry form.
How do I prevent 1 or more characters from being entered into a textbox.
For example: one textbox, I dont want a user entering slashes or single quotes.
In another textbox, I dont want the user entering single quotes.
Have I got to write a whole validation thing, or is there some sort of formatting or regex I can use?
Any response gratefully appreciated.
Mark
|
|
|
|
|
Hi Mark
You can use regular expressions as far as i know to do what you want or you could use a masked textbox in .Net 2.0.
However to do what you want you need to you use the keypress event of a textbox and ignore character you dont want to allow by setting e.handled = true.
Private Sub txtText1_KeyPress(ByVal sender As Object, ByVal e As System.Windows.Forms.KeyPressEventArgs) Handles txtText1.KeyPress
'If the key pressed is ' or " or any type of punctuation mark then do not allow
If e.KeyChar.IsPunctuation(e.KeyChar) Then
e.Handled = True
End If
End Sub
'This will ignore a backslash
If e.KeyChar = Microsoft.VisualBasic.Chr(Keys.OemBackslash) Then
e.Handled = True
End If
Hope this Helps
Keith
|
|
|
|
|
Hi everybody
I work with many projects (Visual basic 2005) that i use in many different solutions, but i have a problem with compiling the projects. I need to set the result dir of all my proyects with base on solution's dir. Ex:
Solution dir: C:\MySolution
Proyects:
project1 code dir: C:\Proyects\Proyect1
Proyect1 result dir: c:\Mysolution\bin
project2 code dir: C:\Proyects\Proyect2
Proyect2 result dir: c:\Mysolution\bin
.....
I won't to change manually all result dir when i change the solution so i hope anyone can help me (i've tried on generation event but doesn't work)
Thank you
.J2
|
|
|
|
|
I suggest not changing the target folders for the build binaries. Instead, go into the Project Properties, Build Events button, and create a Post-Build event that launches a batch file to copy the resulting files to where you need them.
Dave Kreskowiak
Microsoft MVP - Visual Basic
|
|
|
|
|
Thank you very much for your help. This is the solution i need.
.J2
|
|
|
|
|
:(Actually I created a form, which is a MDI.
I then took a form(form 2),which is a child form.
Now when i run the application the child form (form 2)
comes within the MDI.
But now the problem is how i can fix the child form
inside the MDI.
I tried the following code
form2.minimize=false
form2.maximize=false
when i double click the status bar the form size changes
so it moves within the MDI.Now how can i fix it ?.
|
|
|
|
|
Hello,
u need to change it's border style..
i think there is a fixed border style, selete it, u will get ur answer
Thanks,
Ankur Bakliwal
|
|
|
|
|
Hi,
I want to store the Documents in ACCESS But access is accepting only 255 characters.
is it Possible?????.....Pls tel me.... way....
thanking you
somasundaram G
|
|
|
|
|
Access has a type of field called Memo this will probably work for short documents but i doubt it will be able to save large documents.
Regards
Keith
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
