Database

Do you want to know more?
WDevs.com - Member's Software Directories, Blogs, FTP, Mail and Forums

17-Dec-04 2:24

There are no spaces between SET and tblSetup. Also there is a spurious comma just before the WHERE. Finally, your SQL is highly susceptable to SQL Injection Attack. You may wish to read up on what SQL Injection attacks are, and how to prevent them.[^]

Does this help?

Re: SQL Syntax Error

Suresh Prasad17-Dec-04 4:06

Suresh Prasad

17-Dec-04 4:06

Thanks. I will try it out.

Datagrid update

Yulianto.16-Dec-04 16:15

Yulianto.

16-Dec-04 16:15

I`m new to ADO.NET, can we update a table from the datagrid? Thanks

<italic>Work hard and a bit of luck is the key to success.

You don`t need to be genius, to be rich.

Re: Datagrid update

Veera Raghavendra16-Dec-04 17:20

Veera Raghavendra

16-Dec-04 17:20

You can update the database from the datagrid it is possible in web.ui.datagrid.u must use the templates of datagrid properties Poke tongue | ;-P

e.veera raghavendra

Generating wrapper code for SQL Server Stored Procedure

Fraas16-Dec-04 15:32

Fraas

16-Dec-04 15:32

How Can I Generating wrapper code for SQL Server Stored Procedure ??

If You will Go To The Following link you will see an example for Generating wrapper code for Oracle Database .. And Also the author say there is built in tool for Generating wrapper code for SQL Server
http://www.codeproject.com/vb/net/OracleSPWrapper.asp
my question .. where is this tools ???

and thanks with my regarding

Fraas

"Artificial" Server" -beginner question

Anonymous16-Dec-04 13:49

Anonymous

16-Dec-04 13:49

I want to practice my SQL on Excel spreadsheets. When I have a project open in VS2003.NET and open the 'Server Explorer' window, it tells me (as it should) that there are no SQL Servers to connect to.
When I was learning SQL in school we would connect to the Oracle 9 Database on the Network. Now I want to continue practicing SQL/C#, but have no network/database or internet connectivity.
Is there a way I can add an add an "SQL Server" to this path when in fact the "Server" is located on the same laptop.
Please forgive my ignorance on the subject. I'm in no way pretending to know what I'm talking about but very much want to learn...

thanks for your time....

Server Object - Where to find the Dll ?

Vector715-Dec-04 22:37

15-Dec-04 22:37

Hello,

I want to use the command Server.MapPath and need the Server object. Where I can found it for reference ?

Heath Stewart15-Dec-04 23:17

Heath Stewart

15-Dec-04 23:17

The Server property is an intrinsic object accessible from within ASP.NET. You cannot simply use Server.MapPath (which is actually HttpServerUtility.MapPath) because 1) it's an instance method and you cannot instantiate the HttpServerUtility class yourself, and 2) it only works with a given virtual path because it needs to map a virtual path to a physical path. This is specific to both the virtual host and the virtual directory. Even on two different virtual hosts, a virtual directory will map differently to the same physical directory.

For future reference, if you have a question about what assembly a class (not object, which is an instance of a class) is defined in, you can view the bottom of the class documentation topic in the .NET Framework SDK that states what namespace and in what assembly the class (or any Type) is defined.

This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles] [My Blog]

Vector716-Dec-04 1:45

16-Dec-04 1:45

Hello, thx for response. Yes I am working on an ASP.NET project and need the MapPath Method. But if I cannot instantiate it, i have no possibilities accessing it ?

Colin Angus Mackay16-Dec-04 2:34

Do you want to know more?
WDevs.com - Member's Software Directories, Blogs, FTP, Mail and Forums

16-Dec-04 2:34

Vector7 wrote:
Yes I am working on an ASP.NET project and need the MapPath Method. But if I cannot instantiate it, i have no possibilities accessing it ?

Did you read what Heath said? You cannot instantiate it. It is created by the framework for you.

In your page class there is a property called Server[^] which exposes a pre-existing instance of the class which you can use.

Vector716-Dec-04 3:58

16-Dec-04 3:58

I have read it, but still not the correct hint.

This is what I've looked for :

HttpContext.Current.Server.MapPath Smile | :)

Because I didn't found the Server object, I thought I need an explicit IIS dll. But now I found this in the web by chance ( all other places show System.MapPath instead the right ASP.NET Version ).

Heath Stewart16-Dec-04 5:26

Heath Stewart

16-Dec-04 5:26

You can also access the Server property from the Page class (or rather the instance of the Page for your code, if you're running within a .aspx for example).

Excuse me for wondering why you're trying to access the Server property when you posted in the ADO/ADO.NET forum. Next time please use the appropriate forum, i.e. the ASP.NET forum.

This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles] [My Blog]

Vector716-Dec-04 23:41

16-Dec-04 23:41

Excuse me for wondering why you're trying to access the Server property when you posted in the ADO/ADO.NET forum. Next time please use the appropriate forum, i.e. the ASP.NET forum.

Because I am developing a DB Application, where I need this in the connectionstring.

How to databound listbox with three table relational structure?

Heath Stewart17-Dec-04 1:00

Heath Stewart

17-Dec-04 1:00

It's still a question about ASP.NET. If you had a question about how to do a particular operation in C# you'd ask in the C# forum. The context of the application isn't as important as the context of the question. We don't know what you're writing, but if you ask in the right forum you'll get a more appropriate response.

This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles] [My Blog]

Origon15-Dec-04 22:31

Origon

15-Dec-04 22:31

Hi, I have a little problem with data bounding a listbox, it works just fine when I bound the listbox to a “parent -> child” structure but when I want to bound it to the following structure I just can’t get it to work.

product (table)
- prod_id (PK)
- prod_name

category (table)
- cat_id (PK)
- cat_name

product_category_relation (table)
- prod_id (PK)
- cat_id (PK)

product (one to many) -> product_category_relation <- (one-to-many) category

I want to get the category names into a listbox when a product is chosen through data bounding, any help in the right direction is much appreciated, thanks in advance.

Reporting Service : custom parameter

Member 150632215-Dec-04 5:42

Member 1506322

15-Dec-04 5:42

I have just recently created a few reports for this web app we are working on. Upon constructing the reports and connecting them to some stored procedures i noticed that the parameters passed to the report only allow a single selection for a specific parameter.. for example if you have an employee parameter it only allows a single selection which sucks if you want the user to be able to pick a few employees.

i was wondering if anyone had information on creating or modifying the current reporting Service Api that renders reports so that one could create custom parameter selection tools.

here is an example of what im looking for.
http://dspace.dial.pipex.com/town/drive/xxg48/CustomParameters.html

any information would be great!

Help ! Selective SQL Statement

RDoes15-Dec-04 1:16

RDoes

15-Dec-04 1:16

Hi there,

Who can help me with this one.
I have a form with a Checkbox treeview. Now the user select one or more items.
I want execute a procedure which gets all the items selected in the treeview.
I tryed a procedure similar like the example

CREATE PROCEDURE dbo.GET_InstrumentReport @SELECTED varchar(2000) AS
SELECT *

FROM tblKBRLIJST

WHERE (tblKBRLIJST.ID = @SELECTED) AND (tblKBRLIJST.Valid = 1)
GO

The Parameter @SELECTED conains the value's like '44&67&89'
When Execute this only the first one is returned.
any solution ?

Thanks.

Michael Potter15-Dec-04 11:12

Michael Potter

15-Dec-04 11:12

Your query string should look like:

SELECT *
FROM tblKBRLIJST
WHERE tblKBRLIJST.ID IN (44,67,89) AND tblKBRLIJST.Valid = 1

Your problem is how to form (44,67,89) from a parameter. The easy way would be to use sp_executesql

CREATE PROCEDURE dbo.GET_InstrumentReport 
(
    @Selected NVARCHAR(2000) 
)
AS
    DECLARE @sql NVARCHAR(2000)
   
    SET @sql = N'SELECT * FROM tblKBRLIJST WHERE tblKBRLIJST.ID IN (' + 
               REPLACE(@Selected,'&',',') +
               N') AND tblKBRLIJST.Valid = 1'

    EXEC executesql @sql

You can't use the parameter directly because it mixes values with SQL syntax. SQL syntax will be ignored if it is used as a parameter. Therefore, you must build the entire string by hand and pass it as a string.

Note: You should add some protection for SQL injection in the above code.

Colin Angus Mackay15-Dec-04 12:28

Do you want to know more?
WDevs.com - Member's Software Directories, Blogs, FTP, Mail and Forums

15-Dec-04 12:28

Michael Potter wrote:
You should add some protection for SQL injection in the above code.

I did something similar, but what I did was to write some code that created a temporary table and dumped all the values in there and then performed an INNER JOIN between the temp table and the main table. That would protect against the SQL Injection Attack element.

RDoes15-Dec-04 22:22

RDoes

15-Dec-04 22:22

Thanks for the quick response,

I consider both solutions.
The solution from Michael Potter is nice as long I do not pass a to big amount of
parameters (the variable is limited to a max of 8000 bytes)
but as long it is less (for me its meaning that I can max lookup approx 50 records)
then it works fine for me.

But.
The last one takes some more programming but there isn't a limit on the max
records to select.
Do you use a real table or a table what is only in memory ?
If you use a real table do you use a table for each user or running procedure ?

The currently App I am writing does not have sensitive data so I am not worry about the
SQL Attack injection

So I think that I use the first solution for now and work the second solution out
when I planned to make a updated release.

Colin Angus Mackay16-Dec-04 2:26

Do you want to know more?
WDevs.com - Member's Software Directories, Blogs, FTP, Mail and Forums

16-Dec-04 2:26

RDoes wrote:
Do you use a real table or a table what is only in memory ?

I use a temporary table. i.e. When you create it you prefix the table name with a # and SQL Server puts it in the tempdb. At the end of the stored procedure it automatically drops the table for you.

RDoes wrote:
If you use a real table do you use a table for each user or running procedure ?

All tables are real. But the table is very short lived. You can create a large table if you want (e.g. if you are going to pass the same values several times then there is no point in recreating a table each time)

RDoes wrote:
but as long it is less (for me its meaning that I can max lookup approx 50 records)
then it works fine for me.

If you need more than 50 records (assuming that is the max you can do with an 8000 char parameter can handle) then you probably want to populate the table outside the stored procedure. In which case you may with to have a permanent table and add an extra column to prevent clashes between various users running procedures with the table at the same time.

RDoes wrote:
The currently App I am writing does not have sensitive data so I am not worry about the
SQL Attack injection

If I told you that through a SQL Injection attack it is possible to attack more than just SQL Server would you reconsider? For example I could use a SQL Injection attack to format the disk, or break out in to other parts of the operating system. It is even possible to compromise machines remote to the SQL Server if they are all within a trusted network.