ASP.NET

paypony wrote:

Is this stored procedure can be injected?

paypony wrote:

also how to recover from it?

paypony wrote:

what is asp.net without database

paypony wrote:

Why are you waisting your time,

paypony wrote:

what is asp.net without database. And i m executing procedure from asp.net frontend ok

paypony wrote:

if you dont know about sql injections.

estatekhoj wrote:

consider upgrading MySQL client.

estatekhoj wrote:

India Real estate
Website Development

sneha Choudhary wrote:

I googled and found that I should set up the database again.

d@nish wrote:

Show some code how you are trying to access the table. That would help.

using System;
using System.Collections;
using System.Configuration;
using System.Data;
using System.Data.SqlClient;
using System.Linq;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.HtmlControls;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Xml.Linq;

public partial class _Default : System.Web.UI.Page
{
    protected void Page_Load(object sender, EventArgs e)
    {
        if(!Page.IsPostBack)
        {
        BenefitsData();
        WelcomeData();
        list_of_courses();
        Latest_News();
        }
    }
    public void WelcomeData()
    {
        SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["newcon"].ConnectionString);
        SqlCommand cmd = new SqlCommand();
        cmd.Connection = con;
        cmd.CommandText = "select Welcome from dbo.STATICDATA";
        cmd.Connection.Open();
        SqlDataReader rdr = cmd.ExecuteReader();
        while (rdr.Read())
        {
            string welcome_text = rdr["welcome"].ToString();
            LblWelcomeText.Text = welcome_text;
        }
        cmd.Connection.Close();
    }

    public void BenefitsData()
    {
        SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["newcon"].ConnectionString);
        SqlCommand cmd = new SqlCommand();
        cmd.Connection = con;
        cmd.CommandText = "select Benefits from dbo.STATICDATA";
        cmd.Connection.Open();
        SqlDataReader rdr = cmd.ExecuteReader();
        while (rdr.Read())
        {
            string benefits_text = rdr["Benefits"].ToString();
            LblBenefits.Text = benefits_text;
        }
        cmd.Connection.Close();
    }

    public void Latest_News()
    {
        SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["newcon"].ConnectionString);
        SqlCommand cmd = new SqlCommand();
        cmd.Connection = con;
        cmd.CommandText = "select top 1 headline,submit_time from dbo.NEWS order by submit_time desc";
        cmd.Connection.Open();
        SqlDataReader rdr = cmd.ExecuteReader();
        while (rdr.Read())
        {
            string head = rdr["headline"].ToString();
            LblMainHeadline.Text = head;
            string dat = rdr["submit_time"].ToString();
            LblDate.Text = dat;
        }
        cmd.Connection.Close();
    }

    public void list_of_courses()
    {

        SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["newcon"].ConnectionString);
        SqlCommand cmd = new SqlCommand();
        cmd.Connection = con;
        cmd.CommandText = "select course_name,pdf_file from dbo.COURSES";
        SqlDataAdapter sda = new SqlDataAdapter(cmd);
        DataTable dt = new DataTable();
        con.Open();
        sda.Fill(dt);
        DataView dview = dt.DefaultView;
        DataCourses.DataSource = dview;
        DataCourses.DataBind();
        con.Close();
    }
}