Database

7-Feb-06 7:38

Hi,

I am having date format problem with asp & mssql. Please help!

consider a table below

id dt
-- ---
1 2006-02-01 00:00:00.000

In the webform create 1 textbox & 1 button

User type a date in the textbox (format "dd/MM/yyyy hh:mm:ss tt" for example 28/02/2006)

In the button click event, write the update command to update the date with the textbox value in the 1st record.

Now the record should look like as below

id dt
-- ---
1 2006-02-28 00:00:00.000

The updated date can be displayed in a label or by using response.write as below

response.write(format(ds.tables("dt").rows(0).item(1),"dd/MM/yyyy hh:mm:ss tt"))

Please give me the code to implement these functions. I think the details given by me are sufficent and you understand my problem. I already posted regarding this problem but i can't able to rectify the problem. Please reply as soon as possible with the working solution.

Thanks in advance Rose | [Rose]

Dave Kreskowiak7-Feb-06 8:01

7-Feb-06 8:01

dansoft wrote:
write the update command to update the date with the textbox value in the 1st record.

And the code you've written for this is??? It's kind of impossible to tell you what you're doing wrong if you don't show us what you're doing to perform this update!

RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

dansoft7-Feb-06 15:48

7-Feb-06 15:48

Dave Kreskowiak wrote:
show us what you're doing to perform this update!

User type a date in the textbox (format "dd/MM/yyyy hh:mm:ss tt" for example 28/02/2006)

I want the update command to update the date in the 1st record.
str="update test set dt='" & txtDt.text & "'" & "where id=1"

I don't know how to format that date in text box while updating. Because the user enter date in "dd/MM/yyyy hh:mm:ss tt" format. Please give me the code for implement this kind of update.

Now the record should look like as below

id dt
-- ---
1 2006-02-28 00:00:00.000

Thanks

Dave Kreskowiak7-Feb-06 16:11

7-Feb-06 16:11

First, why are you having the user type all that junk in when you're only using the date?

Next, don't use string concatentation to build SQL queries. You open yourself up to SQL Injection attacks and it just makes your job that much harder when you're trying to debug problems.

Use SqlParameters to do this. It'll format the date for you if you parse the textbox string into a DateTime object first.

Learn to pass parameters correctly before you get into the habit of doing it the wrong way. SQL Injection Attacks and How to Prevent Them[^]

RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

dansoft7-Feb-06 17:54

7-Feb-06 17:54

I found the following code solved my problem.

<br />
Dim format As New System.Globalization.CultureInfo("en-GB", True)<br />
Dim dt As DateTime = DateTime.Parse(myDate.Text, format)<br />
dim str as String= "update myTable set dt='" & dt & "'" where id=1<br />
Dim cmd As New SqlCommand(str, con)<br />
con.Open()<br />
cmd.ExecuteNonQuery()<br />
con.Close()<br />

This code will update the date in format "dd/MM/yyyy HH:mm:ss tt"

Dave Kreskowiak8-Feb-06 2:08

8-Feb-06 2:08

Yeah, it does.

But what if I typed this into your textbox:

01/01/1999' DROP TABLE test --

What do you think would happen?

RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

dansoft8-Feb-06 2:53

8-Feb-06 2:53

Dave Kreskowiak wrote:
01/01/1999' DROP TABLE test --

It will display error.

See one more problem. The datagrid is displaying all the records in page load. After the search command it is loading that search result. But the problem is when i clik the next page it will display all the records. cause i use that query in the pageindexchanged event. can you guide me to solve this problem?

Thanks

Dave Kreskowiak8-Feb-06 11:58

8-Feb-06 11:58

dansoft wrote:
It will display error.

Don't be so sure. You're right, this time. This little attack works much better when you concatenate the WHERE of an SQL statement:

"SELECT * FROM table WHERE field = '" & text & "'"

This will generate an SQL statement that looks like this:

SELECT * FROM table WHERE field = '01/01/1999' DROP TABLE table --

Which WILL NOT generate an error. I guarantaa you'll start scratching your head wondering where your table went.

As for paging, you can find a bunch of articles on it by looking through these[^].

RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

dansoft9-Feb-06 7:37

9-Feb-06 7:37

Dave Kreskowiak wrote:
SELECT * FROM table WHERE field = '01/01/1999' DROP TABLE table --

this will not happen because i'll convert the textbox value to datetime format and using the try catch method. So it will display error message. I checked..

Thanks

Dave Kreskowiak9-Feb-06 11:10

9-Feb-06 11:10

You're not getting it... Sigh | :sigh:

Well, you're putting the conversion in NOW. You're previous posts just used the value entered in a TextBox. The "conversion" saves you in this particular case. But try converting a username or password into something else to "verify" it's not SQL "unfriendly".

You just DO NOT concatenate strings together to build SQL statements in real-world code. You have to do so much more to validate that the entered data can do no harm, it's silly. Even after it's been "verified", you still must treat any user input as hostile to your database and write your code accordingly.

Write write your SQL code so the database (without any external help at all) can practically run itself just using stored procedures, views, and triggers. Then you wrap your C# code around that.

If you attempt to get junk like this into a retail product, you'll lose your job immediately.

RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

dansoft9-Feb-06 14:37

Net-Programer-and-developer

9-Feb-06 14:37

Thanks for your advise.

Can i use sqlcommand parameters to avoid these kind of attacks? I'm not very advanced in either mssql or asp.net

If possible please send me some sample files that meet the retail product...

Thanks again.

inserting images

Net-Programer-and-developer7-Feb-06 5:30

7-Feb-06 5:30

Hi all,

I was trying to insert a image into my table but it showing a binary data and i was unable to retrive the same image. it is giving some junck characters or some times it is giving binary numbers.

sowjanyakumar

Re: inserting images

Dave Kreskowiak7-Feb-06 7:59

Re: sql server credentials

7-Feb-06 7:59

.Net Programer and developer wrote:
it is giving some junck characters or some times it is giving binary numbers.

What is "IT"? An image is just a bunch of data that, when looked at in raw form is a string of junk characters. So what you're seeing is normal, depending on what you're looking at this "junk" with.

RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

sql server credentials

Dimitris Iliopoulos7-Feb-06 4:47

Dimitris Iliopoulos

7-Feb-06 4:47

I have written a program that access an sql server 2000 database installed on a windows 2003 server machine. Sql server is setup with integrated security and i don't want to change this. if i install my app in a computer that is a member of the domain and logins windows with the credentials of a windows server user account works good. Is there anyway from a computer that is on the same network that logins using a local windows account and does not have access to network resources access sql server? the result i want to have is :asking username and password for a windows 2003 server user account within my app and authenticate the user against windows server when the user wants to access the db.

Thanks in advance

From Greece:
Dimitris Iliopoulos
dimilio@yahoo.com

Mike Dimmick7-Feb-06 5:45

Mike Dimmick

7-Feb-06 5:45

If I recall correctly, you can do the same as you do with Windows file sharing: create an account with the same username and password on the server as on the client computer. Integrated Security will fall back on NTLM authentication which should succeed if the passwords match.

This is very hard to maintain, of course.

When adding the account (or group) to SQL Server, to authorize the account to connect, use the server machine name where you would use the domain.

Stability. What an interesting concept. -- Chris Maunder

Cumalative Sum and Supply/Demand Delay

T-Smooth7-Feb-06 4:41

T-Smooth

7-Feb-06 4:41

Hi,

I have a table consisting of the following columns of relevance:

Day - Integer ranging from 1-9
Demand_Qty - Double value specifying the demand for that particular day.
Demand_Filled - Doulbe value specifying how much of the item was recieved that day.

What I need to find out is how many days it takes before each demand is filled. For example:

Day Demand_Qty Demand_Filled Days_to_Fill
1 10 0 2
2 10 0 2
3 20 10 1
4 5 30 1
5 10 10 -1

The first 3 columns are provided and the Days_to_Fill column is what I need to calculate. A -1 in the Days_To_Fill means the demand was never met. As you can see, the Demand for Day 1 is 10, which is not filled until Day 3. If further clarification is needed, pls inquire.

I'm not sure exactly where to begin so any tips/ideas/solutions would be greatly appreciated. One thing that I believe could get me closer to a solution would be acquiring a cumalative sum of Demand_Qty and Demand_Filled for each day, but I don't know how to do this in SQL... anyone know how? What I mean is a sum that would look like this based on the above sample:

Day SumDemand SumFilled
1 10 0
2 20 0
3 40 10
4 45 40
5 55 50

Thank you for any help in advance, hoping I can get a solution figured out soon for my Project Manager.

-Tom

If statement in select clause... Help!

awisey7-Feb-06 4:25

awisey

7-Feb-06 4:25

Hi all,
Im new to this area of code project,

Just woundering if its possible to have a if statement in the select clause of a sql query in sql server.
I need to convert the ms access version sql:

<br />
Select IIf([OD_STOCK_CODE] Like "**BUPN**",([OD_UNITCST]*0.7)*[OD_QTYORD],0) AS BOXDisc<br />

to an equivilent ms sql syntax

Any ideas
thanks in advance

Re: If statement in select clause... Help!

Mike Ellison7-Feb-06 5:56

Mike Ellison

7-Feb-06 5:56

Hi there. Take a look at the CASE statement in Sql Server. You probably want something like this:

Select Case When [OD_STOCK_CODE] Like '%BUPN%' Then ([OD_UNITCST] * 0.7) * OD_QTYORD
            Else 0
        End as BOXDisc

Re: If statement in select clause... Help!

Michael Potter7-Feb-06 5:58

Michael Potter

7-Feb-06 5:58

Use the CASE statement:

SELECT 
    CASE
        WHEN OD_STOCK_CODE LIKE '%BUPN%' THEN (([OD_UNITCST]*0.7)*[OD_QTYORD])
        ELSE 0
    END AS BOXDisc
FROM
    WhateverTable

As a side note, you can use as many WHENs as you need for your logic.

SQL & DAO Connection

paykani6-Feb-06 18:00

paykani

6-Feb-06 18:00

the connection is DAO, OS is winxp, I want to disable SSPI. do you know how it is possible?

Re: SQL & DAO Connection

Dave Kreskowiak7-Feb-06 7:56