Click here to Skip to main content
15,890,336 members
Home / Discussions / Database
   

Database

 
AnswerRe: what is the cursor? Pin
originSH3-Jun-07 23:25
originSH3-Jun-07 23:25 
AnswerRe: what is the cursor? Pin
ganesamoorthidhayalan4-Jun-07 2:20
ganesamoorthidhayalan4-Jun-07 2:20 
AnswerHomework alert Pin
leckey4-Jun-07 4:06
leckey4-Jun-07 4:06 
GeneralRe: Homework alert Pin
originSH4-Jun-07 5:19
originSH4-Jun-07 5:19 
GeneralRe: Homework alert Pin
leckey4-Jun-07 9:55
leckey4-Jun-07 9:55 
QuestionSQL 2000 Reporting Services - Blank pages while rendering matrix in PDF format Pin
Ravindranath Kini3-Jun-07 19:07
Ravindranath Kini3-Jun-07 19:07 
QuestionDTS Package..?? Pin
Xandip3-Jun-07 17:23
Xandip3-Jun-07 17:23 
QuestionBasic SQL question Pin
eggie53-Jun-07 14:42
eggie53-Jun-07 14:42 
I have some code (C#) that runs an SQL update query that sets the value of a column to what the user passes. So, this causes an error when anything the user passes in has a ' character in it. I'm sure there's other characters that'll break it too. So, I was wondering, how do I get around this? Is there some commonly accepted regex pattern that will make the value safe to run in an SQL query? How can I take care of any values that need to be escaped?

I'm not using any fancy ado.net objects:

string sql= [whatever the user passes in]

SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings[Utils.GetConnectionString].ToString());
        connection.Open();

        SqlCommand command = connection.CreateCommand();
        command.CommandType = CommandType.Text;
        command.CommandText = sql;


        try
        {
            int result = command.ExecuteNonQuery();

            if (result != 1)
            {
                Response.StatusCode = 500;
                Response.Write("The file has been uploaded, but we could not update the DB");
                Response.End();
            }
        }
        catch (InvalidOperationException)
        {
            Response.Clear();
            Response.Write("error");
            Response.StatusCode = 500;
            Response.End();
        }

        connection.Close();



/\ |_ E X E GG

AnswerRe: Basic SQL question Pin
Arun.Immanuel3-Jun-07 14:51
Arun.Immanuel3-Jun-07 14:51 
AnswerRe: Basic SQL question Pin
Christian Graus3-Jun-07 14:53
protectorChristian Graus3-Jun-07 14:53 
GeneralRe: Basic SQL question Pin
eggie53-Jun-07 15:00
eggie53-Jun-07 15:00 
GeneralRe: Basic SQL question Pin
Pete O'Hanlon3-Jun-07 23:46
mvePete O'Hanlon3-Jun-07 23:46 
QuestionMofify a colunm from Nvarchar(50) to DateTime Pin
steve_rm3-Jun-07 9:27
steve_rm3-Jun-07 9:27 
AnswerRe: Mofify a colunm from Nvarchar(50) to DateTime Pin
Mike Dimmick3-Jun-07 12:00
Mike Dimmick3-Jun-07 12:00 
QuestionAccess of Office 2007 as a DB in .NET Pin
Tzumer Edo3-Jun-07 4:27
Tzumer Edo3-Jun-07 4:27 
AnswerRe: Access of Office 2007 as a DB in .NET Pin
originSH3-Jun-07 23:30
originSH3-Jun-07 23:30 
QuestionAdding a new column is DBNULL Pin
steve_rm2-Jun-07 4:06
steve_rm2-Jun-07 4:06 
AnswerRe: Adding a new column is DBNULL Pin
Rob Graham2-Jun-07 5:53
Rob Graham2-Jun-07 5:53 
AnswerRe: mysql vs sqlserver Pin
Rob Graham2-Jun-07 4:55
Rob Graham2-Jun-07 4:55 
QuestionSQL variable in MS Access Pin
Blue_Boy2-Jun-07 2:25
Blue_Boy2-Jun-07 2:25 
AnswerRe: SQL variable in MS Access Pin
Krish - KP2-Jun-07 2:30
Krish - KP2-Jun-07 2:30 
GeneralRe: SQL variable in MS Access Pin
Blue_Boy2-Jun-07 2:50
Blue_Boy2-Jun-07 2:50 
AnswerRe: SQL variable in MS Access Pin
Dave Kreskowiak2-Jun-07 9:28
mveDave Kreskowiak2-Jun-07 9:28 
GeneralRe: SQL variable in MS Access Pin
Ilya Verbitskiy5-Jun-07 4:49
Ilya Verbitskiy5-Jun-07 4:49 
QuestionSelect statement......, Pin
HemMagesh1-Jun-07 20:11
HemMagesh1-Jun-07 20:11 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.