Insert img into sql without using sqlparameter - C# Discussion Boards

BobJanova5-Apr-13 5:12

BobJanova

5-Apr-13 5:12

Why are you doing all this manually? Can't you use tlbimp to generate an interop assembly and let Microsoft handle the plumbing?

Member 99653115-Apr-13 5:21

Member 9965311

5-Apr-13 5:21

Hi
Because I use API of a software and it is impossible to install 2 different versions of this software on a same machine Smile | :)

So some methods change depending of the software version. Maybe it is impossible to make this cast so I will find a workaround Frown | :(

Jason Gleim5-Apr-13 10:51

Jason Gleim

5-Apr-13 10:51

Casting unmanaged objects to managed objects is a daunting task even when things are working properly. And you aren't getting any help if the 3rd-party is changing method signatures between API revisions. That is a cardinal no-no for exactly this reason.

If I had to do this, I would use a mechanism similar to discovering and loading a plug-in at runtime. (And there are articles on CP on how to do that) I would create an interface library that defines a new interface that harmonizes the difference between the two API's. (calling it the harmonized interface) In my application, I would reference that library and use those interfaces in code. Then, I would use the tlbimp tool to generate an initial interop assembly or write my own interop assemblies that will wrap the calls to the specific API versions exposing an object that implements the harmonized interface. The connector libraries would then be responsible for the heavy lifting of marshaling the calls from the harmonized interface to the underlying API-specific objects. In most cases, this should be simply pass-thru type calls but where there are differences I would handle those in an API-specific way in each of these connector libraries.

At runtime, I would need code which detects the correct version of the outside API and loads the appropriate connector library instantiating my interop class(es). Since they implement the common, harmonized interface, my app code would be consistent and the specifics of the underlying API differences are handled in the correct connector library. Where needed, I would use the underlying API version I detected to call (or not call) certain methods on the harmonized interface as appropriate.

The advantage of this approach is that when the API vendor screws you again with a new version that breaks the current API, you can simply write a new connector library and everything continues to work. If new functionality is added, expand the harmonized interface, implement those new methods in ALL of the connectors, but throw exceptions in the ones where the underlying API doesn't support the new functionality.

Re: About webcam application

Bernhard Hiller7-Apr-13 20:55

Bernhard Hiller

7-Apr-13 20:55

It's a terrible way to go, but I do not see a better one.
Using the dynamic keyword in a common base class for some of the types of ThridParty may help reduce coding - but can lead to problems with some interfaces.

About webcam application

Bishwajit Nepali4-Apr-13 23:56

Bishwajit Nepali

4-Apr-13 23:56

I am trying to develoop an application in c# using Aforge.dll but please anyone give me some idea how to make object (edge detect) through webcam so that i can find approx origina length and breadth

Abhinav S5-Apr-13 0:47

Abhinav S

5-Apr-13 0:47

Possibly http://www.aforgenet.com/framework/features/edge_detectors_filters.html[^] could help.

WP Apps - Color Search | Arctic | XKCD | Sound Meter | Speed Dial

Insert img into sql without using sqlparameter

mohammadkaab4-Apr-13 22:04

mohammadkaab

4-Apr-13 22:04

hi , im working on a website and i want to let the user add their img for their account .
i know one way for adding img into the sqldatabase and its the regular one to using the file stream and then sql parameter , i know that way so far .

but do we have any other way for adding img into sql database without using the sql parameter .
and truly why i should define a sql parameter . is it really necessary to define a sql paramater then just define the type and set it to img and do all of that things ?

Eddy Vluggen4-Apr-13 22:31

4-Apr-13 22:31

mohammadkaab wrote:
is it really necessary to define a sql paramater

Yes. Concatenating the value into the SQL-string is insecure. Hence, all queries with parameters.

Why is it a problem? Don't tell me that it's "too much typing".

Bastard Programmer from Hell Suspicious | :suss:

If you can't read my code, try converting it here[^]

mohammadkaab4-Apr-13 22:51

mohammadkaab

4-Apr-13 22:51

No , absolutly not , when i want to insert some data to the database the only thing i do is to use command text and then do the rest . but i though , inserting img into the database is also like inserting string.
ty anyway.

Eddy Vluggen4-Apr-13 22:55

4-Apr-13 22:55

Any variable inserted should be using a parameter. Also strings.

Bastard Programmer from Hell Suspicious | :suss:

If you can't read my code, try converting it here[^]

mohammadkaab4-Apr-13 23:05

mohammadkaab

4-Apr-13 23:05

con.open();
com.connection = con;
com.commandtext = @"insert into table1 (name,family,id)values('"+textbox1.text+"','"+textbox2.text+"','"+textbox3.text+"')";
com.executenonequery();
con.close();

im using this type of inserting without of sql parameter , so ? is it wrong ?

Eddy Vluggen5-Apr-13 0:29

5-Apr-13 0:29

mohammadkaab wrote:
im using this type of inserting without of sql parameter , so ? is it wrong ?

Yes/no. It's not "wrong" in the sense that it will not compile or run, but it is wrong in the sense of being secure. It's recommended to use parameters to prevent SQL-injection attacks. Concatenating strings is heavily frowned upon, the more there it gives one a headache with formatting dates in different parts of the world.

Bastard Programmer from Hell Suspicious | :suss:

If you can't read my code, try converting it here[^]

Richard Deeming5-Apr-13 1:41

Richard Deeming

5-Apr-13 1:41

Try typing the following in textbox3:

Robert');drop table table1;--

Your query now becomes:

SQL

insert into table1 (name,family,id)values('me','Corleone','Robert');drop table table1;--')

That's two queries - one to insert a record, and one to drop the table. The -- comments out the rest of the query.

Congratulations - you've just met little Bobby Tables[^].

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

BobJanova5-Apr-13 5:15

BobJanova

5-Apr-13 5:15

Yes, it is wrong. Very wrong: anyone with access to the page that submits those text boxes, and an educated guess at the type of query they'll be used in, can now execute arbitrary queries against your database with all the permissions of your script (which, if you're allowing SQL injection, you probably haven't closed down properly either).

Using parameterised queries is most important when you accept free text from the user.

Keith Barrow5-Apr-13 2:44

Keith Barrow

5-Apr-13 2:44

Seriously, as the other have said, doing this is an enormous security hole. You might as well give users direct access to your database.

Now at least three regular members of the site have told you this, hopefully you'll get an idea of how bad it is to do this.

“Education is not the piling on of learning, information, data, facts, skills, or abilities - that's training or instruction - but is rather making visible what is hidden as a seed”
“One of the greatest problems of our time is that many are schooled but few are educated”

Sir Thomas More (1478 – 1535)

Jason Gleim5-Apr-13 11:01

Jason Gleim

5-Apr-13 11:01

Maybe the OP can tell us what his eventual web site address will be so we can all avoid it?

... and no offense to the OP but there should be some sort of test or something before people are allowed to write code that goes out on the net. What if he is writing a web site for kids and putting together the data access layer like this? I shudder to think about the black hats that would be licking their chops to get at the data with something so trivial as the sql injection attack he is inviting with his code.

c# exchange server 2007 set user properties

cursore844-Apr-13 23:25

cursore84

4-Apr-13 23:25

for me the best mode is to use a parameter.
However, you can try to convert image to byte[] and then in string

var str = System.Text.Encoding.Default.GetString(byteArray);

but I'm not sure that it works Unsure | :~

Member 97066334-Apr-13 20:52

Member 9706633

4-Apr-13 20:52

How do i change user properties.

public string SetAttributesValue()
{
try
{
RunspaceConfiguration rsConfig = RunspaceConfiguration.Create();
PSSnapInException snapInException = null;
PSSnapInInfo info = rsConfig.AddPSSnapIn("Microsoft.Exchange.Management.PowerShell.Admin", out snapInException);
Runspace myRunSpace = RunspaceFactory.CreateRunspace(rsConfig);
myRunSpace.Open();
Pipeline pipeLine = myRunSpace.CreatePipeline();

Command myCommand = new Command("Get-user");
myCommand.Parameters.Add("Identity", sUserName);
pipeLine.Commands.Add(myCommand);
Collection<psobject> commandResults = pipeLine.Invoke();

foreach (PSObject cmdlet in commandResults)

{

}

return commandResults.ToString();
}
catch (Exception Ex)
{
MessageBox.Show(Ex.Message);
}

return null;
}

Dll sharing and autoupdate application

jp19814-Apr-13 20:14

jp1981

4-Apr-13 20:14

hey, i m working on a project , i am developing it in visual studio 2010, c# winforms and devexpress (also trying to change it to WPF MVVM)
its a kind of toolbox, toolbox should be generic i.e. if any new tool added, toolbox should automatically add it (when in network), toolbox and tool both should be auto update (i am using clickonce for this), i am using process.start to run a tool from toolbox (bcz toolbox and tools are loosely coupled), but now the new requirement is, that dlls which are using by different tools should reside with toolbox only and tool should have their reference only (i find it very difficult bcz toolbox is loosely coupled with tool) so if you can suggest anything that can help me to keep all dll with one application (toolbox) and other are only using ref. of it (tools)..or in another solution, if we have tight coupling between toolbox and tools (one solution , multiple project) then how can we achieve this function (dll only at one place) also the autoupdate (because clickonce is not supporting multiple project deployment as far as i know)..any help on this is appreciated.

JP
SSE

Eddy Vluggen4-Apr-13 22:29

4-Apr-13 22:29

Read up on interfaces; create one in a new dll, and reference that from the toolbox and the tools.

Bastard Programmer from Hell Suspicious | :suss:

If you can't read my code, try converting it here[^]

jp19814-Apr-13 22:59

jp1981

4-Apr-13 22:59

thanks you. i am working on the solution you suggest. will post my reply as soon as i get it working.

Eddy Vluggen5-Apr-13 7:02

5-Apr-13 7:02

Good luck. I'd recommend doing a small testproject in a new and clean solution. That way you can focus on this particular task without being bugged by any other code.

Bastard Programmer from Hell Suspicious | :suss:

If you can't read my code, try converting it here[^]

AmitGajjar5-Apr-13 20:38

AmitGajjar

5-Apr-13 20:38

What about MEF[^]?

Thanks
-Amit Gajjar (MinterProject)