Click here to Skip to main content
15,890,897 members
Home / Discussions / C#
   

C#

 
AnswerRe: global:: Pin
DaveyM6915-Sep-08 11:15
professionalDaveyM6915-Sep-08 11:15 
QuestionUnmanaged DLL injection under Vista x64 Pin
EURaklap15-Sep-08 9:53
EURaklap15-Sep-08 9:53 
AnswerRe: Unmanaged DLL injection under Vista x64 Pin
Giorgi Dalakishvili15-Sep-08 10:03
mentorGiorgi Dalakishvili15-Sep-08 10:03 
QuestionCheck if a field exists in a table before adding it to another table Pin
Twyce15-Sep-08 9:50
Twyce15-Sep-08 9:50 
GeneralRe: Check if a field exists in a table before adding it to another table Pin
Pete O'Hanlon15-Sep-08 9:55
mvePete O'Hanlon15-Sep-08 9:55 
GeneralRe: Check if a field exists in a table before adding it to another table Pin
Twyce15-Sep-08 10:40
Twyce15-Sep-08 10:40 
QuestionCoding SQL Statement with String Literals Pin
polishprogrammer15-Sep-08 8:41
polishprogrammer15-Sep-08 8:41 
GeneralRe: Coding SQL Statement with String Literals Pin
Pete O'Hanlon15-Sep-08 8:59
mvePete O'Hanlon15-Sep-08 8:59 
polishprogrammer wrote:
I have an application that needs to create SQL statements based on user selection criteria. Therefore, the specific items in the SQL query must be variables. Unfortunately, I'm seeing a problem with a variable that has a quotation mark in it, such as Mark's Fish Market. When the application puts Mark's Fish Market into a query structured something like the following SQL snippet, the application generates an error. What's the best way to encode this variable as a string literal?


AND Owner = '" + strOwner + "'


Well, I wouldn't do that for a start. You've just opened yourself to a whole host of problems because of the potential of SQL Injection Attacks. Use parameterised queries instead - you can create dynamic queries with parameterised queries you know, so have a go at that instead.

Deja View - the feeling that you've seen this post before.

My blog | My articles



GeneralRe: Coding SQL Statement with String Literals Pin
polishprogrammer15-Sep-08 9:01
polishprogrammer15-Sep-08 9:01 
GeneralRe: Coding SQL Statement with String Literals Pin
Pete O'Hanlon15-Sep-08 9:08
mvePete O'Hanlon15-Sep-08 9:08 
GeneralRe: Coding SQL Statement with String Literals Pin
polishprogrammer15-Sep-08 9:28
polishprogrammer15-Sep-08 9:28 
GeneralRe: Coding SQL Statement with String Literals Pin
Giorgi Dalakishvili15-Sep-08 9:28
mentorGiorgi Dalakishvili15-Sep-08 9:28 
GeneralRe: Coding SQL Statement with String Literals Pin
Paul Conrad15-Sep-08 9:48
professionalPaul Conrad15-Sep-08 9:48 
AnswerRe: Coding SQL Statement with String Literals Pin
Paul Conrad15-Sep-08 9:47
professionalPaul Conrad15-Sep-08 9:47 
QuestionCalling c# methods from unmanaged code (Not COM) and vice versa Pin
greenbeast15-Sep-08 8:23
greenbeast15-Sep-08 8:23 
QuestionTreeView flickering? Pin
Cyrilix15-Sep-08 5:56
Cyrilix15-Sep-08 5:56 
AnswerRe: TreeView flickering? Pin
Anthony Mushrow15-Sep-08 10:47
professionalAnthony Mushrow15-Sep-08 10:47 
GeneralRe: TreeView flickering? Pin
Cyrilix15-Sep-08 11:24
Cyrilix15-Sep-08 11:24 
QuestionValidate an EmailID Exist or not Pin
Tiger45615-Sep-08 5:32
Tiger45615-Sep-08 5:32 
AnswerRe: Validate an EmailID Exist or not Pin
Scott Dorman15-Sep-08 5:42
professionalScott Dorman15-Sep-08 5:42 
AnswerRe: Validate an EmailID Exist or not Pin
Paul Conrad15-Sep-08 9:49
professionalPaul Conrad15-Sep-08 9:49 
QuestionImplementation of TimeTable Pin
singhpreeti2315-Sep-08 4:38
singhpreeti2315-Sep-08 4:38 
AnswerRe: Implementation of TimeTable Pin
leppie15-Sep-08 4:48
leppie15-Sep-08 4:48 
GeneralRe: Implementation of TimeTable Pin
singhpreeti2315-Sep-08 19:19
singhpreeti2315-Sep-08 19:19 
GeneralRe: Implementation of TimeTable Pin
Harvey Saayman15-Sep-08 20:55
Harvey Saayman15-Sep-08 20:55 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.