|
I'm constructing a search string based on input from user in a web application. This search string basically translates to a search criteria and is assigned to a RowFilter on a dataview. My code throws an exception when my search strings contains quotes and other SQL characters which might invalidate the search criteria.
How do I make sure that this doesnt happen, ie. how to avoid sql escape characters from my search string. Is there a method in .net which will help me. I tried google, searching for SQL escape characters but I couldnt find anything relevant to what i'm looking for.
Also note that the filtering is done on a dataview which is already on cache.
Thanks,
Kannan
|
|
|
|
|
I think the only problem is with ' and you can just replace it with '' (not a quote, but 2 apostrophies).
|
|
|
|
|
I have this method in one of my utility classes:
public static string ToSQL(object value)
{
if (value == null)
return "NULL";
if (value is string)
return "'" + value.ToString().Replace("'", "''") + "'";
return value.ToString();
}
It's handy for SQL search criteria.
Regards,
Alvaro
Give a man a fish, he owes you one fish. Teach a man to fish, you give up your monopoly on fisheries.
|
|
|
|
|
The easiest way to handle this is used parameterized SQL expressions in ADO.NET. For example, if you use a SqlCommand, use the SqlParameters in the SqlCommand.Parameters (the property documentation includes an example). Constructing the SQL string without the parameters is straight forward enough since you have total control over it. Using parameters for the values (for an INSERT, UPDATE, DELETE, etc.) will eliminate the common problems (trying to inject another statement) while taking care of escaping quotes for you.
This is by far a better and safer alternative. The days of concatenating strings to form a SQL expression are (or at least should be) over.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Thanks for the tip, I was aware of this, but was wondering how one could use them for search criteria as that of a RowFilter which expects a SQL string.
Thanks,
Kannan
|
|
|
|
|
You're on your own, there. There is a good side, though: users can't cause an injection of an invalid SQL statement in the RowFilter property, thus - potentially - whiping out your entire database. An Exception would be thrown if anything is invalid. So, while there's nothing really to help you with that (just good ol' string parsing), there's not much harm in not checking for every possible exploit.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
I have developed following escape function that work fine with gridview rowfilter:
public static string Escape(string aString)
{
string searchStr = Regex.Replace(aString, "[.']", "''");
searchStr = Regex.Replace(searchStr, "[.]]", "[]]");
searchStr = Regex.Replace(searchStr, "[.[]", "[[]");
searchStr = Regex.Replace(searchStr, "[.*]", "[*]");
searchStr = Regex.Replace(searchStr, "[.%]", "[%]");
return searchStr;
}
Before passing string to rowfilter just escape your search string with above function. Should work
|
|
|
|
|
Hi all,
is dynamic loading of appDomains also work in compact framework .net ?
I have run example in dynamic loading in .net framework,
but since compact framework dont have AppDomainSetup Class,
so what can I do ?
The code in dynamic loading in .net framework is in
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dncscol/html/csharp05162002.asp
but when the port the code to compact framework, the code doesn't work coz AppDomainSetup Class is missing in .net CF.
Can anyone point to sample code or articles on it ?
Thanks
|
|
|
|
|
I'm not sure if this fits in the right category under C# Forum. It's a Web-FORM, but Code-Behind is C#.
Gurus, I've been having a bit of a problem.
I want to manipulate the strings that's return
from the database.
Here's the Scenario:-
Front-End ASPX page:-
<asp:dropdownlist id="DropDownList1" Runat="server" AutoPostBack="True">
Code-Behind in c#:- (Assume i populate it on PageLoad)
I'm using DataReader.Execute to read the info retrieve from DB. And let's say the query return 1 column. "FirstName".
DropDownList1.DataSource = dbCmd.ExecuteReader();
DropDownList1.DataTextField = "FirstName";
DropDownList1.DataTextField = "FirstName";
DropDownList1.DataBind();
Now, this works right off the box. It populates the dropdownlist. But, this is not exactly what I want. There are some results from "FirstName" column that I want to manipulate. How do I do that ? In other words, how do i manually tap into the reading loop ?
Any sample code would definately help.
Please advice. Thanks
Stanley
|
|
|
|
|
Three ways come to mind:
1. Change the query to return the data in the format you need it.
2. Retrieve the data in a DataSet (instead of a DataReader), manipulate the DataSet, and bind to that.
3. Loop through the DataReader and add the data manually to the drop down (DropDownList1.Items.Add).
Regards,
Alvaro
Give a man a fish, he owes you one fish. Teach a man to fish, you give up your monopoly on fisheries.
|
|
|
|
|
Hi I've made a DLL because I want to use a library I'm developing many projects (Solutions) using it and since my library is still changing, I wouldn't like to change all my library files in every project when I want to modify my library.
So anyway, I made that dll, which works fine, and I added references to it in my projects, but now the default behaviour of VS.NET is to copy the dll in the local directory. But when they make a copy, the changes I make in my library doesn't apply in the directories in which it's been copied... (obviously).
So I'm wondering how to make this work out, I've tried to change the Copy Local property but I got the error message that says that the compiler can't find the reference...
Anybody can help me?
|
|
|
|
|
goldoche wrote:
But when they make a copy, the changes I make in my library doesn't apply in the directories in which it's been copied... (obviously).
I'm not sure that's true. Doesn't VS.NET automatically recopy any DLLs that have changed?
Regards,
Alvaro
Give a man a fish, he owes you one fish. Teach a man to fish, you give up your monopoly on fisheries.
|
|
|
|
|
Make a project reference instead of an assembly reference. If your projects are in the same solution, right-click on a project and select Add Reference. Then click the Projects tab and select the projects you want to reference. This also establishes a build dependency so that any changes in the dependencies will cause them to be built when you build a project that references them. This will also copy the latest, build-specific (i.e., release, debug, etc.) assembly to the local directory for that project that depends on them.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Thanks a lot... but what is the property "Local Copy" for?
|
|
|
|
|
It determines whether assemblies should be copied locally (to the target directory) or not. Assemblies found in the GAC (typically solidified assemblies - not those you're developing) don't need to be copied; it's a waste of time and space. Set "Local Copy" to false and when you run your app it will use those assemblies from the GAC or any other location you might have configured (via the .config file to configure a private path or assembly codebase, or using a publisher policy to define assembly redirections with an optional codebase).
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
I'm doing a program for a pocket-pc that has a "save as" dialog-box. When I execute it in the explorer, It's ok, but when I try to execute it in pocket-pc it doesn't work, in order to show the dialog-box only appears the text of the file. There is someone who can help me?
Thanks!!
  This is the code:
private void Command3_Click(object sender, System.EventArgs e)
{
Response.ContentType="text/plain";
Response.AddHeader( "content-disposition","attachment; filename=Testa1.txt");
FileStream sourceFile = new FileStrea(@"C:\Inetpub\wwwroot\FitxIdatziWeb\Testa1.txt", FileMode.Open);
long FileSize;
FileSize = sourceFile.Length;
byte[] getContent = new byte[(int)FileSize];
sourceFile.Read(getContent, 0, (int)sourceFile.Length);
sourceFile.Close();
Response.BinaryWrite(getContent);
}
|
|
|
|
|
I am fairly new to programing and am progaming in C#. I am very motivated to create code that is lean. By that I mean not repeating code and creating seperate classes when I need to. I thought that I would pick the brains of the people here at 'The Code Project' and get there opinions on when to create your own classes, and get some general programming formats. Thanks ahead of time. I would love to be enlightend.
Jeff St. Germain, MCP
A fool is a person who doesn't learn from others experience.
--Me
|
|
|
|
|
I recommend you simply start developing your main application. As you discover generic classes/methods that you use (or will use) in multiple places, extract them out to your utility DLL. If these classes belong to a particular area (web, windows, gui, networking), you may consider adding them to a more specific utility DLL.
That's the quickest and easiest way to build up your library of reusable classes.
Regards,
Alvaro
Give a man a fish, he owes you one fish. Teach a man to fish, you give up your monopoly on fisheries.
|
|
|
|
|
I disagree with Alvaro - and many other architects will as well. Start by planning your application. Before writing a single line of code, decide what can be abstracted into separate modules. But start writing code by writing a good toolkit/framework. You should write them generically enough (using a provider pattern, good abstract object model, etc.) so that they can be reused in other applications.
Writing monolithic applications is always a bad idea. Starting from the UI and peeling pieces away will eventually lead to problems where your framework isn't generic enough for abstract use. This is a similar problem found when securing applications - security should never be an afterthought. Neither should a good application design.
Take a look at the .NET Framework Class Library. The assemblies mscorlib and System comprise the base functionality that everything uses. System.Windows.Forms and System.Web for example, could work without the types in those assemblies (nor could anything else - especially without the mscorlib assembly). It's all based on a good foundation.
If you're looking for good books (and the ones I'm recommending are free to download in their entirety), see the MSDN Patterns and Practices[^] site.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Heath Stewart wrote:
I disagree with Alvaro - and many other architects will as well. Start by planning your application. Before writing a single line of code, decide what can be abstracted into separate modules. But start writing code by writing a good toolkit/framework. You should write them generically enough (using a provider pattern, good abstract object model, etc.) so that they can be reused in other applications.
I think we're referring to two different concepts. You're talking about application design, which of course should be done before coding. I was referring to the creation of generic class libraries for use in multiple applications. I argue that those are developed slowly, as the need arises.
For example, say you start programming a Sockets-related project and you notice that the .NET classes don't have a couple of methods that would be really convenient for you. So you develop your own SocketUtil class, add the methods, and build it into your generic Util DLL.
That's how I've created my utility classes over the years, and I argue that most developers (not architects) have created theirs too. In fact, I'm willing to bet that most of the class libraries and utilities published in CP originated because someone had an immediate need for some functionality that they then extracted into a separated module for reuse.
Regards,
Alvaro
Give a man a fish, he owes you one fish. Teach a man to fish, you give up your monopoly on fisheries.
|
|
|
|
|
Designing applications will lead to class libraries. Writing a toolkit is hardly a backward process. Yes, realizing that additional features could be abstracted from applications often happens, but even writing multiple applications at the same time and saving stuff off doesn't really make for a good class library from which applications should be based.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
When you design an application, you usually talk about the classes that will play a role in the life of the application. Classes such as Customer, Order, Product, etc, are application-specific classes that are designed to meet that particular application's needs. You can put them inside a separate DLL and call them a "class library" if you like, but chances are that they'll only be used by one application.
As you start developing the application, you'll notice that the underlying class library (.NET) will not provide all the functionality you need. So you'll end up extracting some of that functionality into a separate DLL to become part of a generic class library.
The main difference between the application-specific class library (A) and the generic one (G) is that A needs to be created/considered every time an application is started, while G is always there and continues to grow as more applications are written.
Regards,
Alvaro
Give a man a fish, he owes you one fish. Teach a man to fish, you give up your monopoly on fisheries.
|
|
|
|
|
You must deal with small applications with a limited scope, then.
I'm talking about interfaces, abstract control classes, utility classes like a preferences provider pattern, configuration sections for those classes, etc. etc.
The framework I architected for our large industrial engineering application is vast and not application-specific until you get a little further up the dependency hierarchy.
Microsoft Office is the same: They have their toolbar code, their their persistence code, the task bar code, etc. They get used in all the products. It's a very abstract design that is not really product specific (depending on your scope of "product").
I guess it really matters what you need to abstract away. Many applications start with a UI toolkit and that tends to get reused throughout a company.
Another factor is that there isn't too levels of abstraction when it comes to toolkits vs. applications. Typically there's many, as with our application. There's a base toolkit (UI, persistence model, COM-like interfaces), a goal-oriented tookit on top of that with additional features, a product-specific toolkit, then the application itself.
Microsoft MVP, Visual C#
My Articles
|
|
|
|
|
Thanks for the insight.
I admit I've never had to build something that large. It's usually been broken in 3 layers:
1. Generic Toolkit (reusable across applications, continually growing)
2. Application Toolkit (reusable within the application, sometimes extending Generic)
3. Application classes (usually extending the Application toolkit)
Regards,
Alvaro
Give a man a fish, he owes you one fish. Teach a man to fish, you give up your monopoly on fisheries.
|
|
|
|
|
Hey Guys!
I am currently working on a Project, but now facing a problem  in how to Monitor a Specific port for Data that is going from my computer to the outer world. E.g. I want to monitor port 'xyz' to check what is goind outside from my computer through this port.
Can anybody help me to solve this problem.
Give Room to Grow your Knowledge by Sharing your Experiences with Others
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
