|
You are injecting values into the SQL String - This is a potential security flaw in your application and you should resolve it. See SQL Injection Attacks and Tips on How to Prevent Them[^]
The resoltion for the security flaw is also the resolution for your problem. You should use Parameterised queries to insert binary data.
|
|
|
|
|
|
I think you meant to reply to the OP rather than me.
|
|
|
|
|
|
Hello there
I need to find out the Columns that make up a key in an existing table...
Say I have a TABLE named USERS, I create a connection and I have a CADOREcordset to that table say we call it cUSERS... It has several keys, one of them is "USERID", I need to find a way (using ADO) to find out what columns make up that Key...
Looking for help, a function like CSTring CgetColumns("USERID"); will be just fantastic...
Cheers
Alex
|
|
|
|
|
I am trying to install SQL EXPRESS on my PC to run with VS 2005.
I had previously uninstalled it.
Now when I try (re)install it won't proceed thru the final steps, showing:
"Existing components have been found" - all options are greyed out & I cannot install.
Any ideas?
Any help is greatly appreciated.
AlanH
|
|
|
|
|
First off, this is a rather complicated mixup I ended up in so I apologize if I'm not being clear enough. If you have any questions, don't hesitate to ask as I greatly appreciate any help you guys can give me on this....
I'm having trouble trying to read tables & stored procedures in Sql 2000's Enterprise Manager, that were originally written in Sql Server 2005. Is there any way I can view this 2005 data in Enterprise Manager?
I started working for a new company a few months ago and was told to develop my first project in the asp.net 2.0 framework & sql server 2005. So for 2 months, I've been developing this project only to discover they made a mistake & told me the wrong thing. All web applications need to use the 1.1 framework and sql server 2000 (They're console apps were the ones that were using 2.0 and sql 2005).
So I spent last week downgrading my application to 1.1 and today, I started downgrading my database stuff to sql 2000. I uninstalled Sql Server 2005 and installed Sql Server 2000. Now however, I'm unable to use Enterprise Manager to open any databases that were created in Sql 2005. I keep getting an error which says to open the tables in Sql 2005.
So my question is, even though I can't view this 2005 data in Enterprise manager, will the stored procedures I create in Sql 2000 still be able to reference any tables & views created in Sql 2005?
Thanks in advance.
-Goalie35
|
|
|
|
|
As a general rule, you cant view or access data or procedures in databases created with a newer release of SQL server (SQL7 didn't like SQL2K either). You should, however, be able to use SQL2005 tools to script the database, then recreate the structures and procedures in an SQL2000 database (the scripts might need editing to account for SQL2K5 specific feature/syntax usage). Youl'll have to "downgrade" your databases as well...
|
|
|
|
|
Basically I want graphs. Like in Excel based on the data, readymade graphs can be made. Is this possible with SQL Server 2000???
Nandini Sharma
|
|
|
|
|
SQL Server can certainly provide the data for the graphs, but it cannot draw them.
|
|
|
|
|
Nandini Sharma wrote: Is this possible with SQL Server 2000???
No.
"We've all heard that a million monkeys banging on a million typewriters will eventually reproduce the entire works of Shakespeare. Now, thanks to the internet, we know this is not true." -- Professor Robert Silensky
|
|
|
|
|
Hi,
I am using datasets to work with the data and populate text boxes appropriately. Something like:
textBox1.Text = dataset.table["tableName"].Row[0].column["LastName"]
In some books, they do databinding like:
textBox.DataBindings.Add("Text", _
table, table.Columns(I).ColumnName)
Which of these methods is better to get used to?
Are these two methods basically the same thing.
Thanks
|
|
|
|
|
Personally, I find data binding to be a real PITA! It always has some limitation which I need to get around, so invariably I just don't use it.
|
|
|
|
|
fmardani wrote: Are these two methods basically the same thing.
Yes and No
If you want to save the data back to the database and use update on the dataadapter, then databinding knows where to pick the values for fields from. If not, and you are doing it manually, there is not much difference.
Shreekar
http://shreekarishere.blogspot.com
|
|
|
|
|
Hey guys.
A little question on transaction best practices:
1. Where do you put your transaction control code? I mean: Do you put it in the code (try catch rollback()), or do you put it in the stored procedure?
2. Do you use transactions for simple insert, delete, update sentences?
Best Regards
Soeren
|
|
|
|
|
Bad Robot wrote: 1. Where do you put your transaction control code? I mean: Do you put it in the code (try catch rollback()), or do you put it in the stored procedure?
Stored Procedure usually, but sometimes I'll need to do several things in sequence so I'll managet the transaction in .NET
Bad Robot wrote: 2. Do you use transactions for simple insert, delete, update sentences?
If it is a simple oneliner then no because SQL Server, by default, will automatically put that in a transaction for me.
|
|
|
|
|
Hello everyone,
I'm looking at building an N-Tier application in .NET and and i'm looking for samples, books or tutorials to get my skills up to scratch. So far the best article i've found is this from MSDN: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dndotnet/html/buildntierapp.asp[^]
has anyone else more experienced in N-Tier applications read this and has any comments or suggestions on the document?
Also, if anyone knows a good book on the topic or any other websites please post and let me know 
Thanks
|
|
|
|
|
hi
I have made an stored procedure but it is not saving records. Can any one point out error in it.
<br />
CREATE PROCEDURE [update__FData]<br />
(@UName [nvarchar],<br />
@FName [nvarchar],<br />
@Given [bigint],<br />
@Pressed [bigint])<br />
<br />
AS UPDATE [TypingTutorDB].[dbo].[_FData] <br />
<br />
SET [Given] = @Given,<br />
[Pressed] = @Pressed <br />
<br />
WHERE <br />
( [UName] = @UName AND<br />
[FName] = @FName)<br />
<br />
GO<br />
Thanks
Syed Shahid Hussain
|
|
|
|
|
Sometimes when I have this problem, it is because I've been sleeping when I created the procedure, and created it in the wrong database. This error usually happens late at night.
Have you been sleeping? 
Best regards,
Soeren
|
|
|
|
|
Bad Robot wrote: Sometimes when I have this problem, it is because I've been sleeping when I created the procedure, and created it in the wrong database.
I think most of us have been there at one time or another. My time is usually first thing on a monday morning when I wonder why none of my tables exist in the "master" database, only to realise 5 minutes later that I forgot to switch to the correct database.
|
|
|
|
|
Exactly, same here - I love to peek over people's shoulders to see if they are also doing this - and 4/10 they do it!!!
Shreekar
http://shreekarishere.blogspot.com
|
|
|
|
|
|
The problem is your parameter data types. You have to set a length for nvarchars.
ex: @UName nvarchar(50)
|
|
|
|
|
You don't use a stored procedure like a table. You execute it rather than select from it. the stored procedure itself may return some records (but doesn't have to, some only create or modify data or structure), but the SP is not itself a valid target for the 'FROM' clause of a select statement.
Your SQL is not valid in ay case, as only one FROM would be expected (possibly multiple tables after the "From" )
You're trying to select results from combinations of results...that won't work.
|
|
|
|
|
I want to change following sql statement to using inner join but I dont know how to join on two column on the two table. Thanks for helping.
select *
from Persons A, Banks B
where B.Student_ID = A.Student_ID
AND B.class_NO = A.claa_NO
when I change to the following statement, I get an error on the syntax. Incorrect syntax near the keyword 'ON'.
select *
from Persons A
INNER JOIN B
ON B.Student_ID = A.Student_ID
ON B.class_NO = A.claa_NO
Please kindly help. Thanks
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
