Click here to Skip to main content
15,888,329 members
Home / Discussions / ASP.NET
   

ASP.NET

 
AnswerRe: How to avoid duplicate data insertion in.net???? Pin
NishantRaval27-Aug-14 23:32
NishantRaval27-Aug-14 23:32 
AnswerRe: How to avoid duplicate data insertion in.net???? Pin
Sibeesh KV29-Sep-14 1:36
professionalSibeesh KV29-Sep-14 1:36 
Questionhow to enable false of iframe page in asp.net not display false by jquery and css? Pin
kp 77715-Aug-14 4:54
professionalkp 77715-Aug-14 4:54 
AnswerRe: how to enable false of iframe page in asp.net not display false by jquery and css? Pin
ZurdoDev15-Aug-14 5:28
professionalZurdoDev15-Aug-14 5:28 
QuestionRequiredfield validator is not working Pin
murali_utr14-Aug-14 18:47
murali_utr14-Aug-14 18:47 
AnswerRe: Requiredfield validator is not working Pin
ZurdoDev15-Aug-14 5:29
professionalZurdoDev15-Aug-14 5:29 
QuestionHow to display certain records if user's search comes up empty? Pin
samflex14-Aug-14 6:20
samflex14-Aug-14 6:20 
SuggestionRe: How to display certain records if user's search comes up empty? Pin
Richard Deeming14-Aug-14 6:45
mveRichard Deeming14-Aug-14 6:45 
samflex wrote:
'Protect against SQL Injection
strSearch = Replace(receiveddate, "'
", "''", 1, -1, 1)
fromdate = Replace(fromdate, "
'", "''", 1, -1, 1)
enddate = Replace(enddate, "'
", "''", 1, -1, 1)

Don't do that! D'Oh! | :doh:

The only way to truly protect against SQL injection is to use a parameterized query. It's not even difficult:
VB.NET
Dim cmd As New SqlCommand("-placeholder-", conn)
Dim sb As New StringBuilder( *** BASE QUERY HERE, up to but not including the "where" keyword *** )

' Hard-code the acceptable values here:
Dim andors As String = IF(ANDOR.SelectedValue = "OR", " OR ", " AND ")
Dim startedWhere As Boolean = False

If facilityT.SelectedValue <> "" Then
    sb.Append(If(startedWhere, andors, " WHERE "))
    sb.Append("i.instructorName = @InstructorName")
    cmd.Parameters.AddWithValue("@InstructorName", facilityT.SelectedValue)
    startedWhere = True
End If

If ViewSelect = "Range" Then
    sb.Append(If(startedWhere, andors, " WHERE "))
    sb.Append("d.trainingDates Between @FromDate And @EndDate")
    cmd.Parameters.AddWithValue("@FromDate", Date.Parse(fromdate))
    cmd.Parameters.AddWithValue("@EndDate", Date.Parse(enddate))
    startedWhere = True
    
ElseIf ViewSelect = "Specific" Then
    sb.Append(If(startedWhere, andors, " WHERE "))
    sb.Append("d.trainingDates = @SpecificDate")
    cmd.Parameters.AddWithValue("@SpecificDate", Date.Parse(strSearch))
    startedWhere = True
End If

cmd.CommandText = sb.ToString()




"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer


GeneralRe: How to display certain records if user's search comes up empty? Pin
samflex14-Aug-14 7:01
samflex14-Aug-14 7:01 
GeneralRe: How to display certain records if user's search comes up empty? Pin
Richard Deeming14-Aug-14 7:28
mveRichard Deeming14-Aug-14 7:28 
GeneralRe: How to display certain records if user's search comes up empty? Pin
samflex14-Aug-14 17:07
samflex14-Aug-14 17:07 
GeneralRe: How to display certain records if user's search comes up empty? Pin
Richard Deeming18-Aug-14 2:02
mveRichard Deeming18-Aug-14 2:02 
GeneralRe: How to display certain records if user's search comes up empty? Pin
samflex18-Aug-14 2:54
samflex18-Aug-14 2:54 
GeneralRe: How to display certain records if user's search comes up empty? Pin
Richard Deeming18-Aug-14 7:15
mveRichard Deeming18-Aug-14 7:15 
GeneralRe: How to display certain records if user's search comes up empty? Pin
samflex18-Aug-14 8:04
samflex18-Aug-14 8:04 
GeneralRe: How to display certain records if user's search comes up empty? Pin
Richard Deeming18-Aug-14 8:38
mveRichard Deeming18-Aug-14 8:38 
GeneralRe: How to display certain records if user's search comes up empty? Pin
samflex18-Aug-14 10:55
samflex18-Aug-14 10:55 
QuestionAJAX control Pin
murali_utr13-Aug-14 23:09
murali_utr13-Aug-14 23:09 
GeneralRe: AJAX control Pin
Kornfeld Eliyahu Peter13-Aug-14 23:18
professionalKornfeld Eliyahu Peter13-Aug-14 23:18 
GeneralRe: AJAX control Pin
murali_utr14-Aug-14 18:00
murali_utr14-Aug-14 18:00 
QuestionGet original string from Guid Pin
Member 947380913-Aug-14 19:06
Member 947380913-Aug-14 19:06 
AnswerRe: Get original string from Guid Pin
Bernhard Hiller13-Aug-14 21:57
Bernhard Hiller13-Aug-14 21:57 
AnswerRe: Get original string from Guid Pin
Kornfeld Eliyahu Peter13-Aug-14 22:27
professionalKornfeld Eliyahu Peter13-Aug-14 22:27 
AnswerRe: Get original string from Guid Pin
Richard MacCutchan13-Aug-14 22:28
mveRichard MacCutchan13-Aug-14 22:28 
QuestionRe: Get original string from Guid Pin
Member 947380915-Aug-14 18:49
Member 947380915-Aug-14 18:49 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.