Click here to Skip to main content
15,904,828 members
Home / Discussions / C#
   

C#

 
AnswerRe: WeakEventHandler Sample Pin
Dave Kreskowiak27-Mar-18 4:32
mveDave Kreskowiak27-Mar-18 4:32 
GeneralRe: WeakEventHandler Sample Pin
Kevin Marois27-Mar-18 5:18
professionalKevin Marois27-Mar-18 5:18 
GeneralRe: WeakEventHandler Sample Pin
Dave Kreskowiak27-Mar-18 9:34
mveDave Kreskowiak27-Mar-18 9:34 
GeneralRe: WeakEventHandler Sample Pin
Kevin Marois27-Mar-18 9:37
professionalKevin Marois27-Mar-18 9:37 
GeneralRe: WeakEventHandler Sample Pin
Dave Kreskowiak27-Mar-18 10:16
mveDave Kreskowiak27-Mar-18 10:16 
GeneralRe: WeakEventHandler Sample Pin
Kevin Marois27-Mar-18 10:17
professionalKevin Marois27-Mar-18 10:17 
QuestionC#, SQL Time period between two columns Pin
Member 1374655226-Mar-18 6:47
Member 1374655226-Mar-18 6:47 
AnswerRe: C#, SQL Time period between two columns Pin
OriginalGriff26-Mar-18 8:20
mveOriginalGriff26-Mar-18 8:20 
Start by not doing that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
SQL
DROP TABLE MyTable;
A perfectly valid "delete the table" command
SQL
--'
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

In this specific case it doesn't expose you to SQL Injection, but it does bring up a different probable problem which may be causing what you have found. When you concatenate strings, you cause an implicit ToString on your DateTime objects which will convert them using the default culture for the computer that is running that code. In most production systems the SQL server is a separate computer (which may not even be in the same country, let alone LAN segment) and that computer may well be configured for a different default date format. So when SQL parse your string, it can very, very easily convert it wrong: you supply dd/MM/yyyy and it reads MM/dd/yyyy for example.

So go through the whole of your app and fix it: remove all string concatenations, replace them with parameterized queries, and see if your problem disappears at the same time...
Bad command or file name. Bad, bad command! Sit! Stay! Staaaay...
AntiTwitter: @DalekDave is now a follower!

AnswerRe: C#, SQL Time period between two columns Pin
MadMyche27-Mar-18 6:05
professionalMadMyche27-Mar-18 6:05 
QuestionOrdering names into list box Pin
Member 1374647825-Mar-18 21:15
Member 1374647825-Mar-18 21:15 
AnswerRe: Ordering names into list box Pin
Richard MacCutchan25-Mar-18 21:42
mveRichard MacCutchan25-Mar-18 21:42 
AnswerRe: Ordering names into list box Pin
OriginalGriff25-Mar-18 21:44
mveOriginalGriff25-Mar-18 21:44 
GeneralRe: Ordering names into list box Pin
#realJSOP26-Mar-18 2:06
professional#realJSOP26-Mar-18 2:06 
GeneralRe: Ordering names into list box Pin
OriginalGriff26-Mar-18 2:13
mveOriginalGriff26-Mar-18 2:13 
GeneralRe: Ordering names into list box Pin
Member 1374647826-Mar-18 2:52
Member 1374647826-Mar-18 2:52 
GeneralRe: Ordering names into list box Pin
OriginalGriff26-Mar-18 3:57
mveOriginalGriff26-Mar-18 3:57 
GeneralRe: Ordering names into list box Pin
#realJSOP26-Mar-18 5:27
professional#realJSOP26-Mar-18 5:27 
QuestionMin and Max or Range Pin
sunsher21-Mar-18 22:52
sunsher21-Mar-18 22:52 
AnswerRe: Min and Max or Range Pin
OriginalGriff21-Mar-18 23:04
mveOriginalGriff21-Mar-18 23:04 
AnswerRe: Min and Max or Range Pin
Gerry Schmitz22-Mar-18 9:00
mveGerry Schmitz22-Mar-18 9:00 
AnswerRe: Min and Max or Range Pin
Eddy Vluggen22-Mar-18 10:24
professionalEddy Vluggen22-Mar-18 10:24 
AnswerRe: Min and Max or Range Pin
#realJSOP23-Mar-18 2:37
professional#realJSOP23-Mar-18 2:37 
SuggestionRe: Min and Max or Range Pin
Richard Deeming23-Mar-18 9:19
mveRichard Deeming23-Mar-18 9:19 
GeneralRe: Min and Max or Range Pin
sunsher24-Mar-18 0:38
sunsher24-Mar-18 0:38 
GeneralRe: Min and Max or Range Pin
#realJSOP24-Mar-18 1:00
professional#realJSOP24-Mar-18 1:00 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.