Click here to Skip to main content
15,904,024 members
Home / Discussions / Visual Basic
   

Visual Basic

 
GeneralRe: Application with calendar menu Pin
Edward Giles25-Jun-13 23:00
Edward Giles25-Jun-13 23:00 
GeneralRe: Application with calendar menu Pin
n38126-Jun-13 3:11
n38126-Jun-13 3:11 
QuestionHow to insert all characters in database Pin
Beiniam3-Jun-13 21:05
Beiniam3-Jun-13 21:05 
AnswerRe: How to insert all characters in database Pin
Bernhard Hiller3-Jun-13 21:22
Bernhard Hiller3-Jun-13 21:22 
GeneralRe: How to insert all characters in database Pin
Beiniam3-Jun-13 22:22
Beiniam3-Jun-13 22:22 
AnswerRe: How to insert all characters in database Pin
Richard MacCutchan3-Jun-13 22:57
mveRichard MacCutchan3-Jun-13 22:57 
AnswerRe: How to insert all characters in database Pin
Simon_Whale3-Jun-13 23:04
Simon_Whale3-Jun-13 23:04 
SuggestionRe: How to insert all characters in database Pin
Richard Deeming4-Jun-13 1:54
mveRichard Deeming4-Jun-13 1:54 
Your code is a classic example of SQL Injection[^]. One mis-placed ' in a text box, and your entire database could be corrupted.

Change the code to use parametereized queries instead:
VB
cmd.CommandText = _
    "INSERT INTO EraDms(DocId, Description, Address, NoOfPages, SendOrReceived, SentDate, ReceivedDate, ForwardedWorkingUnit, Attachements, ForwardedDate, ReceivedBy, DocPath) " & _
    " VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"

' Parameter names don't matter; OleDbCommand uses positional parameters:
cmd.Parameters.AddWithValue("@p0", Me.RefferencNoTxt.Text)
cmd.Parameters.AddWithValue("@p1", Me.DescriptionTextBox.Text)
cmd.Parameters.AddWithValue("@p2", Me.AddressTextBox.Text)
cmd.Parameters.AddWithValue("@p3", Me.NoOfPagesTextBox.Text)
cmd.Parameters.AddWithValue("@p4", Me.SendOrReceievedComboBox.Text)
cmd.Parameters.AddWithValue("@p5", Me.SentDateTextBox.Text)
cmd.Parameters.AddWithValue("@p6", Me.receivedDate.Text)
cmd.Parameters.AddWithValue("@p7", Me.ForwardedWorkingUnitTextBox.Text)
cmd.Parameters.AddWithValue("@p8", Me.AttachementsTextBox.Text)
cmd.Parameters.AddWithValue("@p9", Me.TextBox6.Text)
cmd.Parameters.AddWithValue("@p10", Me.ReceivedByTextBox.Text)
cmd.Parameters.AddWithValue("@p11", Me.DocPathTextBox.Text)


And:
VB
cmd.CommandText = _
    "UPDATE Eradms " & _
    " SET Description = ?, " & _
    " Address = ?, " & _
    " NoOfPages = ?, " & _
    " SendOrReceived = ?, " & _
    " SentDate = ?, " & _
    " ReceivedDate = ?, " & _
    " ForwardedWorkingUnit = ?, " & _
    " Attachements = ?, " & _
    " ForwardedDate = ?, " & _
    " ReceivedBy = ?, " & _
    " DocPath = ? " & _
    " WHERE DocId = ?"

' Parameter names don't matter; OleDbCommand uses positional parameters:
cmd.Parameters.AddWithValue("@p0", Me.DescriptionTextBox.Text)
cmd.Parameters.AddWithValue("@p1", Me.AddressTextBox.Text)
cmd.Parameters.AddWithValue("@p2", Me.NoOfPagesTextBox.Text)
cmd.Parameters.AddWithValue("@p3", Me.SendOrReceievedComboBox.Text)
cmd.Parameters.AddWithValue("@p4", Me.SentDateTextBox.Text)
cmd.Parameters.AddWithValue("@p5", Me.receivedDate.Text)
cmd.Parameters.AddWithValue("@p6", Me.ForwardedWorkingUnitTextBox.Text)
cmd.Parameters.AddWithValue("@p7", Me.AttachementsTextBox.Text)
cmd.Parameters.AddWithValue("@p8", Me.TextBox6.Text)
cmd.Parameters.AddWithValue("@p9", Me.ReceivedByTextBox.Text)
cmd.Parameters.AddWithValue("@p10", Me.DocPathTextBox.Text)
cmd.Parameters.AddWithValue("@p11", Me.RefferencNoTxt.Text)




"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer


GeneralRe: How to insert all characters in database Pin
Beiniam4-Jun-13 3:02
Beiniam4-Jun-13 3:02 
QuestionUnable to Update LDAP property "department" Pin
David Mujica3-Jun-13 10:12
David Mujica3-Jun-13 10:12 
AnswerRe: Unable to Update LDAP property "department" Pin
Bernhard Hiller3-Jun-13 21:20
Bernhard Hiller3-Jun-13 21:20 
GeneralRe: Unable to Update LDAP property "department" Pin
David Mujica5-Jun-13 0:23
David Mujica5-Jun-13 0:23 
QuestionHow difficult to switch from DoEvents to Threading? Pin
treddie2-Jun-13 11:19
treddie2-Jun-13 11:19 
AnswerRe: How difficult to switch from DoEvents to Threading? Pin
Dave Kreskowiak2-Jun-13 19:28
mveDave Kreskowiak2-Jun-13 19:28 
GeneralRe: How difficult to switch from DoEvents to Threading? Pin
treddie2-Jun-13 20:57
treddie2-Jun-13 20:57 
QuestionVB.NET and PHP mysql connection Pin
Amiet_Mhaske2-Jun-13 9:52
Amiet_Mhaske2-Jun-13 9:52 
QuestionThe old DoEvents and UserControls Pin
treddie1-Jun-13 18:41
treddie1-Jun-13 18:41 
AnswerRe: The old DoEvents and UserControls Pin
Dave Kreskowiak2-Jun-13 4:03
mveDave Kreskowiak2-Jun-13 4:03 
GeneralRe: The old DoEvents and UserControls Pin
treddie2-Jun-13 7:21
treddie2-Jun-13 7:21 
GeneralRe: The old DoEvents and UserControls Pin
Dave Kreskowiak2-Jun-13 7:42
mveDave Kreskowiak2-Jun-13 7:42 
GeneralRe: The old DoEvents and UserControls Pin
treddie2-Jun-13 9:26
treddie2-Jun-13 9:26 
GeneralRe: The old DoEvents and UserControls Pin
Dave Kreskowiak2-Jun-13 14:21
mveDave Kreskowiak2-Jun-13 14:21 
GeneralRe: The old DoEvents and UserControls Pin
treddie2-Jun-13 16:33
treddie2-Jun-13 16:33 
GeneralRe: The old DoEvents and UserControls Pin
Dave Kreskowiak2-Jun-13 19:25
mveDave Kreskowiak2-Jun-13 19:25 
GeneralRe: The old DoEvents and UserControls Pin
treddie2-Jun-13 21:02
treddie2-Jun-13 21:02 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.