Click here to Skip to main content
15,887,812 members
Home / Discussions / C#
   

C#

 
GeneralRe: How to Get Values from XML in COMBO BOX Pin
Member 1377710423-Apr-18 1:52
Member 1377710423-Apr-18 1:52 
GeneralRe: How to Get Values from XML in COMBO BOX Pin
OriginalGriff23-Apr-18 1:58
mveOriginalGriff23-Apr-18 1:58 
GeneralRe: How to Get Values from XML in COMBO BOX Pin
Member 1377710423-Apr-18 2:01
Member 1377710423-Apr-18 2:01 
GeneralRe: How to Get Values from XML in COMBO BOX Pin
OriginalGriff23-Apr-18 2:07
mveOriginalGriff23-Apr-18 2:07 
GeneralRe: How to Get Values from XML in COMBO BOX Pin
Member 1377710423-Apr-18 2:10
Member 1377710423-Apr-18 2:10 
QuestionSMS in C# Pin
Member 1349255721-Apr-18 23:17
Member 1349255721-Apr-18 23:17 
AnswerRe: SMS in C# Pin
OriginalGriff21-Apr-18 23:36
mveOriginalGriff21-Apr-18 23:36 
QuestionNpgsqlcommand parameterization doesn't always escape single quote Pin
Member 1379203421-Apr-18 22:24
Member 1379203421-Apr-18 22:24 
Hi all,

First time poster here and excited to interact with the forum.

I'm using C# and Postgres. I rolled my own security to escape the special chars I was aware off (like single quote), but then was advised that I didn't need to do that - parameterization could do it all for me!

So I deleted (archived) my code and replaced it all with parameterized Npgsqlcommands. Great!

However, a bit of testing shows that it doesn't escape single quotes when using NpgsqlCommand.ExecuteReader().

It seems to work fine when I do NpgsqlCommand.ExecuteNonQuery(). I listed my working code at the bottom of this message in case anyone doing this stumbles across it and finds it useful.

I'm kind of a novice, and would really appreciate someone more experienced to look over my code and help me understand what I'm doing wrong.

Here's my method for SQL queries that return data:

public static bool ExecuteSQLQuery(NpgsqlCommand cmdText, out DataTable dataTable)
        {
            try
            {
                string connectionString = ConfigurationManager.AppSettings["connectionString"];

                NpgsqlConnection sqlConnection = new NpgsqlConnection(connectionString);
                sqlConnection.Open();

                cmdText.Connection = sqlConnection;

                dataTable = new DataTable();
                dataTable.Load(cmdText.ExecuteReader(CommandBehavior.CloseConnection));

                sqlConnection.Close();

                return true;
            }
            catch(Exception ex)
            { dataTable = new DataTable();  return false; }
        }


Here's my code for calling that code:

DataTable dataTable = new DataTable();
            NpgsqlCommand sqlCommand = new NpgsqlCommand("SELECT * FROM users.users WHERE (email ilike @email or username ilike @username)");
            sqlCommand.Parameters.AddWithValue("email", NpgsqlTypes.NpgsqlDbType.Varchar, email);
            sqlCommand.Parameters.AddWithValue("username", NpgsqlTypes.NpgsqlDbType.Varchar, username);

DatabaseConnectivity.ExecuteSQLQuery(sqlCommand, out dataTable)


If I feed it a single quote character it fails.

Thanks in advance for any help.

PS: Here's my working code for SQL that doesn't return any data:

public static bool ExecuteSQLNonQuery(NpgsqlCommand cmdText)
        {
            try
            {
                string connectionString = ConfigurationManager.AppSettings["connectionString"];

                NpgsqlConnection sqlConnection = new NpgsqlConnection(connectionString);
                sqlConnection.Open();

                cmdText.Connection = sqlConnection;
                cmdText.ExecuteNonQuery();

                sqlConnection.Close();

                return true;
            }
            catch (Exception ex)
            { return false; }
        }

AnswerRe: Npgsqlcommand parameterization doesn't always escape single quote Pin
OriginalGriff21-Apr-18 22:44
mveOriginalGriff21-Apr-18 22:44 
QuestionPSFEATURE_CUSTPAPER structure - change paper size in virtual printer Pin
Member 1308759421-Apr-18 9:30
Member 1308759421-Apr-18 9:30 
Questionusbclass library Pin
Member 1379116421-Apr-18 4:58
Member 1379116421-Apr-18 4:58 
AnswerRe: usbclass library Pin
OriginalGriff21-Apr-18 5:00
mveOriginalGriff21-Apr-18 5:00 
AnswerRe: usbclass library Pin
jschell21-Apr-18 6:23
jschell21-Apr-18 6:23 
QuestionStateChange event issue in SQL Server 2016 and .net 4.7 ado.net Pin
Arun TBalakrishnan20-Apr-18 14:18
Arun TBalakrishnan20-Apr-18 14:18 
AnswerRe: StateChange event issue in SQL Server 2016 and .net 4.7 ado.net Pin
Gerry Schmitz20-Apr-18 20:19
mveGerry Schmitz20-Apr-18 20:19 
QuestionHow can we copy and move folders in one folder to another folder. Pin
Member 1377710419-Apr-18 20:14
Member 1377710419-Apr-18 20:14 
AnswerRe: How can we copy and move folders in one folder to another folder. Pin
OriginalGriff19-Apr-18 21:35
mveOriginalGriff19-Apr-18 21:35 
AnswerRe: How can we copy and move folders in one folder to another folder. Pin
BillWoodruff20-Apr-18 3:29
professionalBillWoodruff20-Apr-18 3:29 
GeneralRe: How can we copy and move folders in one folder to another folder. Pin
OriginalGriff20-Apr-18 4:09
mveOriginalGriff20-Apr-18 4:09 
GeneralRe: How can we copy and move folders in one folder to another folder. Pin
BillWoodruff20-Apr-18 15:32
professionalBillWoodruff20-Apr-18 15:32 
AnswerRe: How can we copy and move folders in one folder to another folder. Pin
Gerry Schmitz20-Apr-18 7:09
mveGerry Schmitz20-Apr-18 7:09 
QuestionPLEASE HELP ME - I have problem with OpenTK and Loading WaveFront ( obj without materials ) Pin
Jens Eckervogt 19-Apr-18 11:03
Jens Eckervogt 19-Apr-18 11:03 
AnswerRe: PLEASE HELP ME - I have problem with OpenTK and Loading WaveFront ( obj without materials ) Pin
Gerry Schmitz20-Apr-18 7:26
mveGerry Schmitz20-Apr-18 7:26 
GeneralRe: PLEASE HELP ME - I have problem with OpenTK and Loading WaveFront ( obj without materials ) Pin
Jens Eckervogt 20-Apr-18 10:21
Jens Eckervogt 20-Apr-18 10:21 
GeneralRe: PLEASE HELP ME - I have problem with OpenTK and Loading WaveFront ( obj without materials ) Pin
Gerry Schmitz20-Apr-18 12:37
mveGerry Schmitz20-Apr-18 12:37 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.