|
Greetings;
What is the best way with C#.net 2005 or 2008 to ...
I have a db that I only want to get info from (no updates) where the user's pick an ID number, start date and end date for the query. I would not know ahead of time what variables they choose.
So what is the best way to programatically form the query?
below is how we have always done it before.
In VB I have some query's that use variables they are setup this way.
I first added the single quotes i.e. I added sigle quotes i.e. ptID = "'"
& ptID & "'" then added " & ptID & " this gave me dbl,single quote variablename singl,dbl quote. All worked well in VB.
In C# I am trying the same thing SQL server requires the single quote so I am still getting the point with ptID = "'" + ptID + "'" then later " + ptID + ".
All works fine on the development box but on the test box I get errors that indicate that it is this formatting that is the problem.
So in C# what is the correct way to add in variables to the strSQL string. Am I doing it correctly now??
tia
Rafone
Statistics are like bikini's...
What they reveal is astonishing ...
But what they hide is vital ...
<div class="ForumMod">modified on Tuesday, September 23, 2008 12:42 PM</div>
|
|
|
|
|
Use parametrized queries. Your code is open to SQL injection.
|
|
|
|
|
What is the exact error you getting?
Also constructing sql commands this way is not recommended. Instead use something like following:
SqlCommand cmd =new SqlCommand("select * from tablename where id=@id",connection);
cmd.Parameters.AddWithValue("@id",3);
cmd.ExecuteReader(); //or whatever you want.
Checkout my blog at
http://www.nirandas.com/blog/
|
|
|
|
|
System.Exception: Incorrect syntax near '12'.
Rafone
Statistics are like bikini's...
What they reveal is astonishing ...
But what they hide is vital ...
|
|
|
|
|
Paste the code you are using.
Nirandas,
a developer from India.
http://www.nirandas.com
|
|
|
|
|
here ya go. As I said this all worked fine in VB.net. Here is a typical query string
//
strSQL = "SELECT dbo.tblFloat.PointID AS ID, dbo.tblFloat.UTCDateTime, dbo.tblFloat.ActualValue
FROM dbo.tblFloat
WHERE (dbo.tblFloat.PointID = " + ptID + ")"
it is really just 1 line I have broken it up to make it easer to read.
I have found this in the ms knowledgebase
SqlConnection sqlConn;
SqlCommand sqlCommand;
String sQuery;
sQuery = "INSERT INTO DVD (ID, Type, Name) VALUES (@p1, @p2, @p3)";
SqlParameter p1 = new SqlParameter("@p1", this.txtID.Text);
SqlParameter p2 = new SqlParameter("@p2", this.cmbType.Text);
SqlParameter p3 = new SqlParameter("@p3", this.txtName.Text);
Is this the "new" way of doing this?
Would I add,
SqlParameter p1 = new SqlParameter("@ptID", ptID);
Where ptID is the variable that I am trying to pass.
and use that in my Where clause?
if so is there any where you can point me to get more info on doing this? I have lots of queries in the old VB system that will have to be upgraded along with the upgrade to C#.
thx in advance for any help
Rafone
Statistics are like bikini's...
What they reveal is astonishing ...
But what they hide is vital ...
<div class="ForumMod">modified on Tuesday, September 23, 2008 12:17 PM</div>
|
|
|
|
|
Rafone wrote: Is this the "new" way of doing this?
No, unless by new you mean "less than ten years old"...ADODB supports parameterized queries and parameters for stored procedures, and has ever since I started using it (around 1998). It's also been known for at least that long that building query strings using the method you've been working with is unsafe in Web applications due to the possibility of a SQL injection attack. Additionally, this technique is prone to the very error you are now experiencing. Except for an ad-hoc query engine, I would not use the old technique. Whoever the VB programmer was, he shouldn't have been allowed to keep his queries in this form. As to resources, try searching for "SQL parameters" or "parameterized queries" in Google or Live Search and see what comes back.
|
|
|
|
|
Thanks to all who replied.
I found the error. my bad the code in VB had dbl quote then single quote. Apparently that has worked fine for years. In fact it worked fine on my development box. However once the code was starting through the conversion and being run on a test box we starting seeing the error.
I finally realized the the syntax should be single quote then dbl quote it all works fine.
This is a large scale project and these apps that I am upgrading only query for data in the Intranet. There is no writing back to the database.
Thanks for the info. I was really asking for some "best practices" info from you guys...thanks again
Rafone
Statistics are like bikini's...
What they reveal is astonishing ...
But what they hide is vital ...
|
|
|
|
|
Hello,
I have a cube drawn in OpenGl Tao framework.I want to rotate and zoom in/zoom out that cube.Please give me any sample.
regards
aurosikha
|
|
|
|
|
Take a steady grip with both your hands around the monitor.
Lift it up and move it closer to your face while twisting it from side to side.
|
|
|
|
|
You might have better luck in the graphics forum
Harvey Saayman - South Africa
Junior Developer
.Net, C#, SQL
you.suck = (you.Passion != Programming & you.Occupation == jobTitles.Programmer)
1000100 1101111 1100101 1110011 100000 1110100 1101000 1101001 1110011 100000 1101101 1100101 1100001 1101110 100000 1101001 1101101 100000 1100001 100000 1100111 1100101 1100101 1101011 111111
|
|
|
|
|
Have a look at view/world transformation matricies.
|
|
|
|
|
I have another problem that has me perplexed.
I have a ToolStripStatusLabel on a StatusStrip. I change the BackColor
of the form that the StatusStrip is on. The ToolStripStausLabel's
background is painted in the form's BackColor.
I created an event handler for the BackColorChanged event on the
ToolStripStatusLabel and it is never fired.
I then created an event handler for the Paint event of the
ToolStripStatusLabel. It gets fired. I check the BackColor of the
ToolStripStatusLabel and it is the same as that for the StatusStrip.
But the background of the ToolStripStatusLabel is still painted in the
BackColor of the containing form.
So I am either missing something, or I have discovered a bug in the .NET
framework.
Has anyone encountered something like this before?
Brian
|
|
|
|
|
I am working on a application on .net 2.0. Sometime would update the app.config setting. However, my app do not get the updated app.config setting until i rebuild the app.
Do anyone tell me y and help me fix the problem. Thanks~~~
|
|
|
|
|
Its not a problem, thats how it works...
When your changing the app.config from visual studio your changing the one that sits with your code, when you build the app a copy of it is created and put with the exe so that it can access the app.config
Harvey Saayman - South Africa
Junior Developer
.Net, C#, SQL
you.suck = (you.Passion != Programming & you.Occupation == jobTitles.Programmer)
1000100 1101111 1100101 1110011 100000 1110100 1101000 1101001 1110011 100000 1101101 1100101 1100001 1101110 100000 1101001 1101101 100000 1100001 100000 1100111 1100101 1100101 1101011 111111
|
|
|
|
|
Hi,
My problem is that I want to delete the nth line of a text file where n is the line number. I guess I could create StreamReader and use ReadLine() to read each line and store it in an array. Then I guess I could re-write the file using the array and omit the nth index.
But when I delete a line I don't want to renumber the subsequent lines. how I could do that?
Any guidance or help for this problem would be greatly appreciated.
Thanks,
Crul23
|
|
|
|
|
Renumber the subsequent lines? I don't follow that. Lines in a text file
are not numbered.
Otherwise I would suggest deleting the text in the line just leaving an
empty text line there. this would leave the same number of lines in the file, but delete the text of the line you want to delete.
Brian
|
|
|
|
|
Crul23 wrote: and store it in an array
I wouldn't do that if you could be passed a very large file. Better to write the lines to a temporary file as you go and then move/rename it to replace the original version when you're done.
You could even shift the content within the existing allocated space, but that might not be worth the trouble.
Crul23 wrote: I don't want to renumber the subsequent lines
Overwriting the existing line with SPACEs is simple.
Of course, if this is a class assignment, pick a way that will impress the teacher.
|
|
|
|
|
Hmm, this is a class assignment but I dunno if I'm suppose overwrite the line with spaces. Then again how else can the subsequent line numbers stay the same right? Hmm, I'll have to find out.
Also, what do you think would impress the teacher lol?
--Crul23
|
|
|
|
|
Crul23 wrote: Hmm, this is a class assignment but I dunno if I'm suppose overwrite the line with spaces. Then again how else can the subsequent line numbers stay the same right? Hmm, I'll have to find out.
What line numbers are you talking about? Text files in Windows do not have line numbers. Some editors will display line numbers once you load a text file into them, but the operating system doesn't provide these.
Crul23 wrote: Also, what do you think would impress the teacher lol?
If you don't know, you may want to ask your teacher, because we certainly can't tell you.
|
|
|
|
|
I have always added a "Settings" File to my project. Then used the Property Grid control to allow users to view/edit the Settings.
I'd like to allow for a cleaner configuration interface. (The property grid is just an table of all the options listed in alphabetical order) I'd like to be able to group options together and have things like checkboxes instead of True/False selections)
I have spent several hours searching for a good approach to binding windows forms controls to a Settings file or similar and surprisingly haven't come across anything quite like what i was looking for.
I did find some asp.net articles which allow for XMLDataSets to be binded to a form but this option doesn't appear to be available in C# Windows forms projects.
If someone could point me in the right direction, i'd really appreciate it.
Thanks in Advance,
~blake
http://www.blakerobertson.com
|
|
|
|
|
Hi,
My application working fine in the dev environment.But in the testing /production environment
it is not working because that environment has only
windows server 2003
IIS
I have prepared a MSI which will automatically install .net2.0 framework
In my application I have Used some microsoft VC++ dll's also along with .net dll's.
Now Iam getting "<b>RUNTime Error</b>" pop-up screen message as below
" <b>The Application has been terminated in an Unusual Way</b>"
On googling i came to know that some dll's like msvcrt.dll of windows server 2003 has to be changed...But Iam not pretty sure about it..
In Production/test environment there is only framework installed ,but there is no visual studio installed on it.may be due that this error may occur...
So kindly post your suggestions and views to help me
|
|
|
|
|
|
I want to add item to my listbox if a mouse is clicked in the area between the two items. Is that even possible couldn't find anything on famous www.google.com.
|
|
|
|
|
Not sure, but have a test with MouseDown event, which will give you coordinates and GetChildAtPoint method.
The need to optimize rises from a bad design
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
