Visual Basic

paas wrote:

if his UserID was being passed as a string, you can not concatenate queries in Access

paas wrote:

And, since UserID is actually being passed as an integer, I do not see how a nefarious user would be able to sneak an 'Or' conditional into the where command that will automatically make the result True.

paas wrote:

but that can also be handled easily with a Replace statement, and without the use of parameterized queries.

Create PROC prc_Update
(
@Password varchar(40),
@UserID int
)
AS
Update tblLogin 
set Password=@Password
where UserID =@UserID

String strcon = ConfigurationManager.AppSettings.Get("MYConnectionstring");

       SqlConnection con;

       SqlCommand cmdupdate;

       public int Update_Password(String Password,int id)
       {
           con = new SqlConnection(strcon);

           cmdupdate = new SqlCommand();

           cmdupdate.CommandText = "dbo.prc_Update";

           cmdupdate.CommandTimeout = 0;

           cmdupdate.CommandType = CommandType.StoredProcedure;

           cmdupdate.Parameters.Add("@Password", SqlDbType.VarChar, 40).Value = Password;

           cmdupdate.Parameters.Add("@UserID", SqlDbType.Int, 4).Value = id;

           cmdupdate.Connection = con;

           int Results = 0;

           try
           {
               con.Open();

             Results = cmdupdate.ExecuteNonQuery();

           }
           catch (SqlException)
           {
               throw;
           }
           finally
           {
               con.Close();
           }
           return Results;

       }

neetu149 wrote:

sir i started a voluntary blood donors information service

neetu149 wrote:

. the application must be simple without installing any extra softwares like dot net,ms access, sql, etc,.

Christian Graus wrote:

I hope that doesn't mean you're collecting blood with the competence you're showing here.

neetu149 wrote:

the application must be simple without installing any extra softwares like dot net,ms access, sql, etc,.