|
Heath Stewart wrote:
How are you "saving" this data?
person.Address = txtAddress.Text; // person.Address is a string property
And then:
txtAddress.Text = person.Address;
And sometimes in between it is saved to and read from a database with a:
strSQL = "UPDATE ..... Address='" + person.Address + "' ....";
and read from the database with a:
person.Adress = datareader.GetString(...);
When I try output that person.Address to a printer, it comes out correctly in several lines.
Now that I'm typing it here, I'm thinking that the problem could be in the UPDATE statement. Any ideas?
-- LuisR
Luis Alonso Ramos
Intelectix - Chihuahua, Mexico
Not much here: My CP Blog!
|
|
|
|
|
The first problem with your UPDATE statement is...
...NEVER use string concatentation to build SQL queries! Thing for a moment what happens when I set txtAddress.Text to the following (which gets assigned to person.Address, which gets passed to your query):
blah' AND 1=1; DROP TABLE YourTable; -- You get 0wned - that's with a zero. If you store credit card numbers, I could grab those. And don't think I can't - I can easily read your IL and string literals with tools that even come in the .NET Framework SDK (ildasm.exe). Major RDBMS's like SQL Server and Oracle support quering for schema information, so I can also find out what columns, tables, views, and databases you have (among other things).
Use parameterized queries. If this is for SQL Server, you'd use the SqlCommand.Parameters collection property, which is well-documented and includes examples. Be sure to read them, because different ADO.NET providers provide support parameters differently: both SQL Server and Oracle drivers support named parameters (but identified a little differently), while the OLE DB provider you must use question marks (?).
The problem could be in how your storing the data. All strings are encoded somehow, and your database encoding might be the problem - same as I mentioned for the text files (though databases typically abstract this problem away).
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
Heath Stewart wrote:
...NEVER use string concatentation to build SQL queries!
You got a very good point there. I had not thought of that before, but in this particular case, this would not be a problem. It's a very little Windows Forms app using a VistaDB database (similar to an Access database, a single file, residing locally). But I definitely need to look into parametized queries.
On Monday, I'll take a look at how the database does the string encoding. If I remember correctly, the multiline text box shows only one non-printable character where a line break should go, so I could probably fix it by adding a carriage return if only a new-line is present, or viceversa.
Thanks, and I'll keep you informed of my findings.
-- LuisR
Luis Alonso Ramos
Intelectix - Chihuahua, Mexico
Not much here: My CP Blog!
|
|
|
|
|
Luis Alonso Ramos wrote:
but in this particular case, this would not be a problem.
I never said it was the problem, but it's a serious problem nonetheless. SQL injection attacks are one of the most overlooked problems and the easiest to exploit. Add to the problem that too many people run as privileged accounts. Always use the least privileges required. You should set up a separate account for your web site (if using database authentication) or add your ASP.NET account (by default, the local ASPNET account added during installation of the .NET Framework) if using SSPI (Windows Integrated Authentication) and give it only the privileges on objects (tables, views, and stored procedures) that are necessary.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
Hello again,
On the same app I talked about the previous thread, my MDI child form has a toolbar and many textboxes.
I use the textboxes' Validated event to set a modified flag and save the value to an internal object. When I click the Save button on the MDI child toolbar, the object is saved to the database.
My problem is that if I modify a text box, and then click the save button on the toolbar, the Validating/Validated events are not generated, because the textbox doesn't lose focus. I have to go to another control, and then click save on the toolbar.
Any ideas on how to fix this or why this is happening?
-- LuisR
___________
Luis Alonso Ramos
Chihuahua, Mexico
www.luisalonsoramos.com
|
|
|
|
|
Make sure CausesValidation is set to true.
If you have a custom control that was implemented differently you can force validation. My company used the following code in some of our projects:
public class Tasks
{
public static void ForceControlValidation(Control c)
{
Type t = typeof(Control);
MethodInfo m = t.GetMethod("NotifyValidating", BindingFlags.Instance | BindingFlags.InvokeMethod | BindingFlags.NonPublic);
object obj = m.Invoke(c, new object[0]);
if (obj is bool && (bool)obj == false)
{
MethodInfo m2 = t.GetMethod("NotifyValidated", BindingFlags.Instance | BindingFlags.InvokeMethod | BindingFlags.NonPublic);
m2.Invoke(c, new object[0]);
}
}
}
Does anyone have something that works better? Please let me know.
This posting is provided "AS IS" with no warranties, and confers no rights.
Alex Korchemniy
|
|
|
|
|
Alex Korchemniy wrote:
Make sure CausesValidation is set to true.
All controls have CausesValidation set to true.
The Validating/Validated events are generated when the control loses focus, for every control. But when I click on the toolbar, the focused control doesn't lose it. That's why it's value is not saved.
If I modify a control, click on some other control, and then the toolbar, there is no problem.
-- LuisR
___________
Luis Alonso Ramos
Chihuahua, Mexico
www.luisalonsoramos.com
|
|
|
|
|
The ToolBar class in the BCL - and most other third-party toolbars I've seen - never gain the focus.
You need to invoke validation when a button is clicked. Since the ToolBar class in the BCL fires a single event for any button click, it makes it easy to do this: just call the function that implements your functionality before checking which button was clicked (well, in most cases I would imagine).
How do you implement this? There are several ways, such as recursively enumerating your Controls collection for each Control (starting at your Form, UserControl, or whatever control you're extending or using for your container) and check the Focused property defined by the Control class (so every control has it, but they may not implement it - like the Panel class).
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
Heath Stewart wrote:
The ToolBar class in the BCL - and most other third-party toolbars I've seen - never gain the focus.
So, that's the problem then.
Heath Stewart wrote:
There are several ways, such as recursively enumerating your Controls collection for each Control
That's easy enough. I'll implement it Monday morning.
Thanks for your help!
-- LuisR
Luis Alonso Ramos
Intelectix - Chihuahua, Mexico
Not much here: My CP Blog!
|
|
|
|
|
Heath Stewart wrote:
You need to invoke validation when a button is clicked.
How do I do invoke events for a control?
If it were a single control, I'd know in advance the event handler name and could call it directly. But I don't know. Also, I implemented the ValidateFocusedControl routine in my base clase, so it doesn't have access to derived clases' members.
I tried this:
public void ValidateFocusedControl()
{
foreach(Control ctl in Controls)
if(ValidateFocusedControlRecursive(ctl))
break;
}
bool ValidateFocusedControlRecursive(Control ctl)
{
if(ctl.Focused)
{
if(ctl.CausesValidation)
{
CancelEventArgs cea = new CancelEventArgs();
cea.Cancel = false;
ctl.Validating(ctl, cea);
if(cea.Cancel != true)
ctl.Validated(ctl, new EventArgs());
}
return true;
}
foreach(Control ctl2 in ctl.Controls)
if(ValidateFocusedControlRecursive(ctl2))
return true;
return false;
}
The recursion code works, I confirmed it with a MessageBox. But how can I call the validation routines? the above code gives me a compile error.
Thanks,
-- LuisR
Luis Alonso Ramos
Intelectix - Chihuahua, Mexico
Not much here: My CP Blog!
|
|
|
|
|
That's what the protected OnEventName methods are for. Note that calling these won't necessary perform the same actions as when the .NET Framework invokes them (like for mouse events), but in this case it will fire validation events that will invoke the handler list.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
Heath Stewart wrote:
That's what the protected OnEventName methods are for.
But I don't have access to the protected members. I want to call them for a control belonging to a form, from the form. Any ideas?
-- LuisR
Luis Alonso Ramos
Intelectix - Chihuahua, Mexico
Not much here: My CP Blog!
|
|
|
|
|
Reflection, or if you're referring to specific controls extend it and then you can call it (perhaps expose the protected member via a public member like Validate).
You could also make the control lose focus and regain it like so:
Control active = ActiveControl;
Control next = active.GetNextControl(active, false);
next.Focus();
active.Focus(); * To avoid getting into a case where invalid input (like no data for a required field) try searching back when possible.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
Hello Heath,
Finally fixed it. This is what I did:
public void ValidateFocusedControl()
{
foreach(Control ctl in Controls)
if(ValidateFocusedControlRecursive(ctl))
break;
}
bool ValidateFocusedControlRecursive(Control ctl)
{
if(ctl.Focused)
{
if(ctl.CausesValidation)
{
TextBox txtBox = new TextBox();
txtBox.Bounds = new Rectangle(-100, -100, 1, 1);
txtBox.Parent = ctl.Parent;
txtBox.Focus();
ctl.Focus();
txtBox.Parent = null;
txtBox.Dispose();
}
return true;
}
foreach(Control ctl2 in ctl.Controls)
if(ValidateFocusedControlRecursive(ctl2))
return true;
return false;
}
Basically, just create a control, set focus to it, and then set the focus back to my control. It works!
Thanks for all your help!
-- LuisR
Luis Alonso Ramos
Intelectix - Chihuahua, Mexico
Not much here: My CP Blog!
|
|
|
|
|
You shouldn't instantiate and add that TextBox with each iteration of your loop! Talk about sucking up system resources. Instantiate it once in the first method, then pass a reference to it in the recursive method.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles] [My Blog]
|
|
|
|
|
I only create the TextBox if the current control has focus and causes validation events. It is not for every control, only when I find the focused one. And once I find it, I immediately return and the loop stops. I believe that TextBox is created only once every time I call the main ValidateFocusedControl routine.
And still I only force validation when the Save button is clicked on the toolbar, so that's once or twice in the life of the form.
-- LuisR
Luis Alonso Ramos
Intelectix - Chihuahua, Mexico
Not much here: My CP Blog!
|
|
|
|
|
Hello,
I have a MDI application, with several types of MDI children. When I get a ButtonClick event from the toolbar in the main form, I want to determine the active MDI child, so I can react appropiately.
I have some code that looks like this:
void ToolBar_OnButtonClick()
{
foreach(Form form in this.MdiChildren)
{
if(form.Focused && form.WindowState != Minimized)
{
if(form is FormType1)
MessageBox.Show("form type 1 active");
else if(form is FormType2)
MessageBox.Show("form type 2 active");
}
}
}
I would expect a messagebox telling me the type of the active form when I click a button on the toolbar, but nothing happens. Any ideas?
-- LuisR
___________
Luis Alonso Ramos
Chihuahua, Mexico
www.luisalonsoramos.com
|
|
|
|
|
See ActiveMdiChild property.
For more information see: MSDN[^]
This posting is provided "AS IS" with no warranties, and confers no rights.
Alex Korchemniy
|
|
|
|
|
Alex Korchemniy wrote:
See ActiveMdiChild property
Exactly what I need. Actually I looked for something named like MdiActiveChild or MdiChildren.ActiveForm before posting this message. I just missed the exact wording.
Thanks!
-- LuisR
___________
Luis Alonso Ramos
Chihuahua, Mexico
www.luisalonsoramos.com
|
|
|
|
|
Hello,
I have a dataTable in my database with columns title, category, problem(description of the problem) and solution. I want to develop a good search mechanism for certain problems so that the user can search for problems – solutions, when he quotes a search term. But I think it is not a good search mechanism when the specific problem with solution is only displayed when the user quotes the correct title of the problem. Is there any other possibility, which is not so difficult to implement?
Regards
mat
|
|
|
|
|
This is more of a database thing. You're going to have more luck asking in the SQL / ADO / ADO.Net Forum [^]
It boils down to how you query the database. SQL is where you need to solve the problem. Moving data into C# and using ADO.NET is not the way to go.
This posting is provided "AS IS" with no warranties, and confers no rights.
Alex Korchemniy
|
|
|
|
|
I think I can make it with Full Text Search. Does anbody know how the SQL Query String should look like, when I want to retrieve all titles of the dataTable when the quoted search term occurs in the title or the problem description or the solution?
As said my columns are
Title
Category
Problem
Solution
Regards
|
|
|
|
|
The syntac for FREETEXT is as follows:
FREETEXT ( { column | * }, 'freetext_string' )
Where
- Column is a full-text index-enabled column, to which the search is directed.
- * specifies that all columns are enabled for full-text search and that the search is directed to these columns
- 'freetext_string' specifies the search criteria. This has to be data of type char, varchar, nchar, nvarchar, or any other character data.
An example:
USE Pubs
GO
SELECT pr_info
FROM pub_info
WHERE FREETEXT (pr_info, 'PuBLiShInG')
This posting is provided "AS IS" with no warranties, and confers no rights.
Alex Korchemniy
|
|
|
|
|
But I use SQL Server 2000 and there I find no menu point FUll Text Search enable. What can I do in that case?
|
|
|
|
|
I have just read that the SQL Server CE does not support Full Text Search. Is there any other possibilty to get such an mechanism??
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
