|
Dayekh wrote: sSql = sSql & " WHERE inProjectID = " & iProjectID & " AND inStageID = " & iStageID
What is it with people injecting crap into their SQL Strings? This way lies SQL Injection Attacks!
Please, please, please will people learn about how to secure their database from attack: SQL Injection Attacks and Tips on How to Prevent Them[^]
|
|
|
|
|
Thanks for informing me of this  .
As you have realised, I am quite new to SQL  .
It was quite interesting to read about the Injection Attacks  .
But be wary mate, there will always be people who are unaware of this 
Thanks again. I will see how I can change it. 
|
|
|
|
|
Dayekh wrote: But be wary mate, there will always be people who are unaware of this
The number of people that were unaware seemed to be going down for a while and in the last few days there has been a spate of people that have really compromisable code.
I'll just have to keep up the fight to ensure that as many people understand what a SQL Injection Attack is and how to write better code.
|
|
|
|
|
Hi,
First of all, write a store procedure that will contain all the queries in your view. If you want to check some condition
you can do it in a stored procedure too. (iProjectID and iStageID). You will have to learn the sql syntax of IF statements.
The values which i told you in last sentence, will be passed as input parameters to the stored procedure. This can be done
as told by other poster, using the command object and setting its CommandType property to StoredProcedure. Then add the
parameters to be passed to the stored procedure.
One of the things you might be wondering about, how to return multiple rows from a stored procedure. If you just
execute the query from SP and fill dataset using data-adapter, then you will get data tables for all your queries in the dataset.
"A good programmer is someone who looks both ways before crossing a one-way street." -- Doug Linder
coolestCoder
|
|
|
|
|
Thank you mate! I didn't realise SPs can be so flexible. I will surely have a crack at that.
Also, to the fight against injection attacks.. Keep up the good work!
|
|
|
|
|
create your command the same way, then set it's CommandType as System.Data.CommandType.StoredProcedure.
Add the parameters to the command's Parameters using .Add();
then do an ExecuteReader().
|
|
|
|
|
I'm still not done here by the way.. feel free to read my question
|
|
|
|
|
hai every one
i need a coding for textbox which allows only 30 characters including white space and it should block special characters.
thank u
Dhatchinamoorthy.R
9894824838
|
|
|
|
|
Which special characters?
|
|
|
|
|
|
Hi
I'm developing an application wherein I'm calling some classes in webforms which do some searching,addition etc on the database. Now what I need to know is how can I code the classes in such a way that if I need to call these classes through web service I won't have to redo the code.
Thanks
Don't Quit
|
|
|
|
|
Encapsulate the functionality in a class, then use that class in any project. You can add the class to the GAC or simply use xcopy.
|
|
|
|
|
Hi, Firstly thanks for replying. I'm already aware of these things what I'm asking is can a single class serve both webservice & web form. As in a web service syntax is little different like [WebMethod] attribute etc.
Regards
Don't Quit
|
|
|
|
|
I have hosted a site and they have given 5 email id to put my mail. how can i check that mail from my application. can i assess these mails from my application. plz. provide some tips.
Bharat Bhusanam
|
|
|
|
|
|
Dear Friends:
In numeric style of page number in GridView , how can I set the font-color or back-color of current page number?
Mazy
"One who dives deep gets the pearls,the burning desire for realization brings the goal nearer." - Babuji
|
|
|
|
|
Have you checked the PagerStyle and PagerSettings properties?
|
|
|
|
|
Yes, they apply on all of the fonts in footer , and do not specify current page number.
|
|
|
|
|
As a workaround, Try to use the following to access that label:
The Current Page is called CurrentPageLabel. Assign it a class in the aspx, or try this:
GridViewRow pagerRow = CustomersGridView.BottomPagerRow;
Label pageLabel = (Label)pagerRow.Cells[0].FindControl("CurrentPageLabel");
Once you have the label, you can assign it a css class.
|
|
|
|
|
Thanks , I'll check it. 
|
|
|
|
|
i am working on a web application i want to implement file uploading and downloading directly from the user. like user upload diectory or download directly from FTP server..
Please help me ..
Send me some Demo or articls
|
|
|
|
|
Downloading is as simple as placing a link directly to the file you wish to allow your users to download. So if you want to allow your users to download an MS word document use something like "href='http://www.yourWebSite.com/subFolderName/helpFile.doc'".
Uploading requires a little bit of code. Check out this tutorial:
http://www.codeproject.com/aspnet/fileupload.asp[^]
Good luck!
-Goalie35
|
|
|
|
|
how to upload multiple Directories/Folders on the Server
plzz send me some Demo Or Link
|
|
|
|
|
I don't entirely understand. Are you looking to upload multiple folders to the server or are you trying to upload a single file to multiple folders located on the server?
As far as I know, you can't upload folders directly to a server, only files (someone please correct me if I'm wrong). If you want to upload an entire directory, you should first zip it up and then upload this zipped file to the server.
hth
-Goalie35
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
