Click here to Skip to main content
15,887,267 members
Home / Discussions / C#
   

C#

 
GeneralRe: System.ArgumentOutOfRangeException: Index was out of range Pin
computerpublic6-Mar-14 7:44
computerpublic6-Mar-14 7:44 
AnswerRe: System.ArgumentOutOfRangeException: Index was out of range Pin
BobJanova6-Mar-14 7:04
BobJanova6-Mar-14 7:04 
GeneralRe: System.ArgumentOutOfRangeException: Index was out of range Pin
computerpublic6-Mar-14 7:47
computerpublic6-Mar-14 7:47 
GeneralRe: System.ArgumentOutOfRangeException: Index was out of range Pin
computerpublic6-Mar-14 7:49
computerpublic6-Mar-14 7:49 
GeneralRe: System.ArgumentOutOfRangeException: Index was out of range Pin
Richard Deeming6-Mar-14 8:06
mveRichard Deeming6-Mar-14 8:06 
GeneralRe: System.ArgumentOutOfRangeException: Index was out of range Pin
BobJanova6-Mar-14 23:05
BobJanova6-Mar-14 23:05 
Questionupdate command in sqladapter Pin
Moneyzz Sharma6-Mar-14 4:04
Moneyzz Sharma6-Mar-14 4:04 
AnswerRe: update command in sqladapter Pin
OriginalGriff6-Mar-14 4:39
mveOriginalGriff6-Mar-14 4:39 
The @name stuff is a parameter, and it allows you to transfer information from your C# code to SQL without converting it to string, or concatenating strings. This is important, because not using parameters can be very dangerous.
Suppose you have a string you want to update against an integer id:
C#
using (SqlConnection con = new SqlConnection(strConnect))
    {
    con.Open();
    using (SqlCommand com = new SqlCommand("UPDATE myTable SET myColumn1='" + myNewString + "' WHERE Id=" + myId.ToString(), con))
        {
        com.ExecuteNonQuery();
        }
    }
Will work, but it leaves you wide open to something called SQL Injection Attacks, where I can use the value in the string to add commands to the UPDATE: if the myNewString variable contains
Hello';DROP TABLE myTable;--

Then what gets passed to SQl is a comannd string:
SQL
UPDATE myTable SET myColumn='Hello';DROP TABLE myTable;--' WHERE Id=666
Which as far as SQL is concerned is two valid SQL commands and a comment.
It updates every row in your table to "Hello", and then deletes the table.

Parametrized queries are a way to avoid that.
C#
using (SqlConnection con = new SqlConnection(strConnect))
    {
    con.Open();
    using (SqlCommand com = new SqlCommand("UPDATE myTable SET myColumn1=@MYSTRING WHERE Id=@ID", con))
        {
        com.Parameters.AddWithValue("@ID", myId);
        com.Parameters.AddWithValue("@MYSTRING", myNewString);
        com.ExecuteNonQuery();
        }
    }
Passes the same info to SQL, but the string value is now passed as a parameter and not interpreted as an SQL command at all.

It is a very, very good idea to use parameters at all times - it prevents other problems as well!

[edit]Typos - loads of typos...Blush | :O [/edit]
Those who fail to learn history are doomed to repeat it. --- George Santayana (December 16, 1863 – September 26, 1952)
Those who fail to clear history are doomed to explain it. --- OriginalGriff (February 24, 1959 – ∞)

SuggestionRe: update command in sqladapter Pin
Richard Deeming6-Mar-14 5:05
mveRichard Deeming6-Mar-14 5:05 
GeneralRe: update command in sqladapter Pin
OriginalGriff6-Mar-14 5:10
mveOriginalGriff6-Mar-14 5:10 
QuestionRe: update command in sqladapter Pin
Moneyzz Sharma6-Mar-14 5:35
Moneyzz Sharma6-Mar-14 5:35 
AnswerRe: update command in sqladapter Pin
OriginalGriff6-Mar-14 6:29
mveOriginalGriff6-Mar-14 6:29 
GeneralRe: update command in sqladapter Pin
Moneyzz Sharma6-Mar-14 8:14
Moneyzz Sharma6-Mar-14 8:14 
GeneralRe: update command in sqladapter Pin
OriginalGriff6-Mar-14 8:27
mveOriginalGriff6-Mar-14 8:27 
QuestionTranslating an "error event" to a managed exception Pin
Bernhard Hiller5-Mar-14 4:17
Bernhard Hiller5-Mar-14 4:17 
AnswerRe: Translating an "error event" to a managed exception Pin
Ravi Bhavnani5-Mar-14 4:25
professionalRavi Bhavnani5-Mar-14 4:25 
GeneralRe: Translating an "error event" to a managed exception Pin
OriginalGriff5-Mar-14 4:38
mveOriginalGriff5-Mar-14 4:38 
GeneralRe: Translating an "error event" to a managed exception Pin
Ravi Bhavnani5-Mar-14 4:46
professionalRavi Bhavnani5-Mar-14 4:46 
GeneralRe: Translating an "error event" to a managed exception Pin
OriginalGriff5-Mar-14 5:13
mveOriginalGriff5-Mar-14 5:13 
GeneralRe: Translating an "error event" to a managed exception Pin
BobJanova5-Mar-14 5:46
BobJanova5-Mar-14 5:46 
AnswerRe: Translating an "error event" to a managed exception Pin
Shameel5-Mar-14 5:07
professionalShameel5-Mar-14 5:07 
AnswerRe: Translating an "error event" to a managed exception Pin
BobJanova5-Mar-14 5:53
BobJanova5-Mar-14 5:53 
AnswerExceptions are exceptional Pin
Ennis Ray Lynch, Jr.5-Mar-14 8:58
Ennis Ray Lynch, Jr.5-Mar-14 8:58 
AnswerRe: Translating an "error event" to a managed exception Pin
jschell5-Mar-14 9:41
jschell5-Mar-14 9:41 
GeneralRe: Translating an "error event" to a managed exception Pin
Bernhard Hiller5-Mar-14 20:17
Bernhard Hiller5-Mar-14 20:17 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.