|
vortex69306930 wrote: The purpose as you can see is so I can use my sqldecode function to parse out the characters that represent apostrophe's.
This is bad practice. It leaves your code open to SQL injection attacks. You should use stored procedures for all CRUD operations. Using stored procedures has the added advantage that you don't need to double up quotes in alphanumeric parameter values.
Paul Marfleet
"No, his mind is not for rent
To any God or government"
Tom Sawyer - Rush
|
|
|
|
|
How can it be bad practice, my function disallows any sql injection attacks by pure nature by removing "'"'s. Observe:
<system.componentmodel.dataobjectmethodattribute _<br="" mode="hold"> (System.ComponentModel.DataObjectMethodType.Insert, True)> _
Public Function SQLencode(ByVal txt As String, Optional ByVal brEncode As Boolean = False) As String
If txt <> "" Then
Dim mySQL As String
mySQL = Replace(txt, "'", "")
If brEncode = True Then
mySQL = Replace(mySQL, vbCrLf, "
")
End If
SQLencode = mySQL
Else
SQLencode = ""
End If
End Function 'SQLencode
<system.componentmodel.dataobjectmethodattribute _<br="" mode="hold"> (System.ComponentModel.DataObjectMethodType.Insert, True)> _
Public Function SQLdecode(ByVal txt As String, Optional ByVal brToVbCrlf As Boolean = False) As String
If txt <> "" Then
Dim mySQL As String
mySQL = Replace(txt, "", "'")
If brToVbCrlf = True Then
mySQL = Replace(mySQL, "
", vbCrLf)
End If
SQLdecode = mySQL
Else
SQLdecode = ""
End If
End Function 'SQLdecode
Now do you think it's bad practice?
|
|
|
|
|
vortex69306930 wrote: Now do you think it's bad practice?
Yes. Of course it is. How does removing apostrophes prevent SQL injection attacks? I suggest you read up on the issue[^] and the consequences for your application.
BTW, your code is really ugly. As I previously mentioned, you can sidestep the whole problem by using parameterized stored procedures.
Paul Marfleet
"No, his mind is not for rent
To any God or government"
Tom Sawyer - Rush
|
|
|
|
|
Hi,
Suppose I am running 3 websites on one client. They have different home pages. How server differentiate the 3 websites and also from where they can be accessible.
Thanks,
sjs4u
|
|
|
|
|
sjs4u wrote: How server differentiate the 3 websites
The websites would exist in separate virtual directories in IIS.
sjs4u wrote: and also from where they can be accessible
What do you mean?
Paul Marfleet
"No, his mind is not for rent
To any God or government"
Tom Sawyer - Rush
|
|
|
|
|
sjs4u wrote:
and also from where they can be accessible
What do you mean?
If we want to access perticular website then how can we know?
whether by ip address or
domain name? or
anything something different.
Thanks,
sjs4u
|
|
|
|
|
sjs4u wrote: If we want to access perticular website then how can we know?
whether by ip address or
domain name? or
anything something different.
I have no idea what you are saying.
Paul Marfleet
"No, his mind is not for rent
To any God or government"
Tom Sawyer - Rush
|
|
|
|
|
sjs4u wrote: whether by ip address or
domain name? or
anything something different.
When you type a domain name, the DNS server (often shortly called as Name Server) looks up its associated IP Address and gives it to your web browser. YOur browser or its associated Proxy server (on your browser's behalf) initiates a HTTP or HTTPS (SSL/TLS) connection with the server. This goes through a number of hops like your ISP, Caching servers etc. But I hope, this can give you a quick insight into what is going on in the background.
Vasudevan Deepak Kumar
Personal Homepage
Tech Gossips
A pessimist sees only the dark side of the clouds, and mopes; a philosopher sees both sides, and shrugs; an optimist doesn't see the clouds at all - he's walking on them. --Leonard Louis Levinson
|
|
|
|
|
So you have multiple Web sites running on your server. One way to do it is to just use different ports. The default port is 80. So if you type www.mywebsite.com:80 is the same thing as www.mywebsite.com. You can add a website in IIS at port 81 so you would type www.mywebsite.com:81.
That is not really a good way to do it since most users will never type the 81. A better way is to give each site it's own IP. So you need to give you server multiple IP's. The assign each individual IP to the website in IIS. You can then DNS each IP to a different name like web1.mywebsite.com and web2.mywebsite.com.
|
|
|
|
|
Hi;
I have tried to add a third gridview to my version of this code (See Editable Nested Gridview article on this site) but I still have some questions about the code.
Such as <ItemTemplate><br />
<a href="javascript:expandcollapse2('div<%# Eval("Institution") %>', 'one');"><br />
<img id="imgdiv<%# Eval("Institution") %>" alt="Click to show/hide Overdraft Summaries for Institution Types <%# Eval("Institution") %>"<br />
border="0" src="plus.gif" width="9px" /><br />
</a><br />
</ItemTemplate>
What is the meaning of the 'one' string used in the expandcollaspe2() call ?
I know that the expected value is row ? Current row ?
Here is the function :
function expandcollapse2(obj,row)<br />
{<br />
var div = document.getElementById(obj);<br />
var img = document.getElementById('img' + obj);<br />
<br />
if (div.style.display == "none")<br />
{<br />
div.style.display = "block";<br />
if (row == 'alt')<br />
{<br />
img.src = "minus.gif";<br />
}<br />
else<br />
{<br />
img.src = "minus.gif";<br />
}<br />
img.alt = "Close to view other Institutions";<br />
}<br />
else<br />
{<br />
div.style.display = "none";<br />
if (row == 'alt')<br />
{<br />
img.src = "plus.gif";<br />
}<br />
else<br />
{<br />
img.src = "plus.gif";<br />
}<br />
img.alt = "Expand to show Institutions";<br />
}<br />
}
And finally when I try to all a third DVG I am not getting it to display. I have taken care to repeat the code sequence done to get the second grid to display, which it does.
So for grid 3 I create a template column in grid2 like so:
<br />
<asp:TemplateField><br />
<ItemTemplate><br />
<tr><br />
<td colspan="100%"><br />
<div id="div<%# Eval("typeName") %>" style="display: none; position: relative; left: 15px;<br />
overflow: auto; width: 92%"><br />
<asp:GridView ID="GridView3" AllowPaging="True" AllowSorting="true" BackColor="White" , ETC.<br />
IN MY CODE BEHIND I SETUP MY FUNCTION TO RETURN A DATASET:
Private Function ChildDataSource2(ByVal strInstitution As String, ByVal strTypeName As String, ByVal strSort As String) As AccessDataSource<br />
<br />
Dim strQRY2 As String = ""<br />
Dim dsTemp2 As AccessDataSource = New AccessDataSource()<br />
dsTemp2.DataFile = "App_Data/aGreatDB.mdb"<br />
<br />
strQRY2 = "SELECT Institution, AcctNum, AcctName, ODDate, [Rundate]-[ODDate] As DaysOverdrawn, CurrentOD, OFFICERS_NAME, OFFICER_CODE, " _<br />
& "Income, Principle, NetOD AS COB_OD, TypeName FROM qryDetail2 WHERE Institution = '" & strInstitution & "' AND TypeName = '" & strTypeName & "' " + strSort<br />
<br />
dsTemp2.SelectCommand = strQRY2<br />
Return dsTemp2<br />
<br />
End Function<br />
I also have a question about where this function should be called. Do I call this in Gridview1.ROWDATABOUND or in GRIDVIEW2.ROWDATABOUND ?
This is my code to call the dataset function:
Dim gv2 As GridView = New GridView()<br />
gv2 = row.FindControl("GridView3")<br />
<br />
' 'Expand the Child grid<br />
ClientScript.RegisterStartupScript(Me.GetType(), "Expand", "<script language="javascript">expandcollapse2('div" + e.Row.DataItem("Institution").ToString() + "','one');</script>")<br />
End If<br />
<br />
'Prepare the query for Child GridView by passing the Institution of the parent row<br />
gv2.DataSource = ChildDataSource2(e.Row.DataItem("Institution").ToString(), e.Row.DataItem("TypeName").ToString(), strSort)<br />
gv2.DataBind()
If my function is expecting two PARMS is this correct syntax for the e.Row.DataItem method call ?
Sorry if I have exceeded my in message code limit.
Thanks for any suggestions or insights !
|
|
|
|
|
i need to let the user see some of the data in a table that contains lots of records and when he scroll down the other valus appear
ex: i have more then 200000 record i want the user to see only 1000 and when he scroll down he will see the other 1000 and so on not forgetting that no need for the control to load the whole 200000 record only 1000 per scrol...
thanks
|
|
|
|
|
You could do this using AJAX.
No one is going to write your code for you though. You'll have to do this yourself.
Paul Marfleet
"No, his mind is not for rent
To any God or government"
Tom Sawyer - Rush
|
|
|
|
|
Hi friends,
I am using MS.net 2.0 and MSSQL2000.
I have some doubt regarding automatic alert messages.
I have 3 users like U1,U2,U3.
When U1 submit (insert) a data into the database, an alert message will show to U2 and U3.
Be thankful for any suggestion...
They laugh at me; they think I’m different. I laugh at them, ‘coz they are all same!!
CrazySanker
|
|
|
|
|
you can use Trigger for that
|
|
|
|
|
Well, you could use a trigger, but that's rather pointless as the web application already knows when it's inserting something. The trigger could only update something in the database that the other clients could poll for, and the web application can do that by itself without a trigger.
Experience is the sum of all the mistakes you have done.
|
|
|
|
|
The HTTP protocol doesn't support sending anything from the server to the client. All communication is initiated by the client, so the browser has to poll the server at a regular interval if you want the client to be aware of anything that happens on the server.
Experience is the sum of all the mistakes you have done.
|
|
|
|
|
Anybody would be having link of crystal report for formula field in asp.net 2.0 c# ?
Yesterday is a canceled check. Tomorrow is a promissory note. Today is the ready cash. USE IT.
|
|
|
|
|
|
Ahhh, behold, the power of google 
"I guess it's what separates the professionals from the drag and drop, girly wirly, namby pamby, wishy washy, can't code for crap types." - Pete O'Hanlon
|
|
|
|
|
Does Crystal Report Formula Feild has got anything to do with ASP.NET and C#?
- Regards -
J O N
A good thing is a bad thing if it keeps you from the best thing. - Dr. Adrian Rogers
|
|
|
|
|
Hi every body
I have make a "UserControl" which Contains some other controls. this child controls have som properties like colors, styles and etc which are changable in property window (via using [Browsable] in the property definition). now I want to show this properties in property window for the parent control. I know that a way for this, is to redefine the same properties for my parent control but it's not an optimal way so is there any way to inherit the child control's properties in the parent property window?
one another question, when I set the [Browsable(true)] for my defined properties, it shows no preview of my changings in design window and only after I run it in browser the changings appear. does any one know what should I do?
thanks
maryam saboor
|
|
|
|
|
hi ,
i want to store a date in sql server and i want to send mail on that day to that person .........
can any one explain me .. how we can do this ?????
thanks
csn
|
|
|
|
|
1) Write a windows service that runs a select every day
2) Create an SQL Server job that gets called daily and write the code in SQL Server
3) Create a scheduled task in windows to execute an app to do the same things.
Need a C# Consultant? I'm available.
Happiness in intelligent people is the rarest thing I know. -- Ernest Hemingway
|
|
|
|
|
thanks for u reply
Can give some related links ... ,bcoz i dont know window service and how to create sql job ...
thanks
CSN
|
|
|
|
|
csn wrote: how to create sql job
SQL Server Agent[^]
- Regards -
J O N
A good thing is a bad thing if it keeps you from the best thing. - Dr. Adrian Rogers
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
