ASP.NET

Re: How to display results based on employees manager and department

22-Sep-15 17:23

Dear experts,

I do really appreciate your highly valued expertise.

I am trying to think up a solution but I am frozen.

First we have two tables ( I didn't design it in case it is flawed), Emp table and Angulers table.

The emp table contains the following fields:

EmpID,

EmpName

Password

Dept

And several others but those above are the relevant ones.

Then Angulers table with following relevant fieldnames:

EmpID - Foreign Key to Emp table

ManagerID -related to EmpID on Emp table

Status (Status has a value of Pending or Done)

The history:

The process is that employees will log in first to register their grievances and suggest a remedy.

Once an employee is done and clicks the Done button, next time that employee logs in, that employee is no longer allowed to make any changes.

By the way, employees log in with empID as username and Password as password.

This works fine.

Now that that employee is done, his or her manager then logs in to a page called EmployeeSummary.aspx to view a list of his/her employees.

Each manager can view his/her employee based on his/her ID and the department that s/he and his/her employees belong to.

This is where I am having problem.

How do I make a manager log into EmployeeSummary.aspx page and only see those employees that are in his/her department?

Here is the code I am working with but it is coming blank when I run it.

PHP

<div align="center">
    <asp:GridView ID="GridView1" runat="server" AutoGenerateColumns="false" AllowPaging="true"
        OnPageIndexChanging="OnPageIndexChanging" PageSize="10">
        <Columns>
             <asp:HyperLinkField DataNavigateUrlFields="ManagerID,department"
                DataNavigateUrlFormatString="employeeDetails.aspx?ID={0}&Dept={1}" Text="Add Comments" />
            <asp:BoundField ItemStyle-Width="200px" DataField="empname" HeaderText="Employee Name" />
            <asp:BoundField ItemStyle-Width="250px" DataField="department" HeaderText="Department" />
         </Columns>
    </asp:GridView>
</div>

--Code Behind:

    Inherits System.Web.UI.Page
    Protected Sub Page_Load(ByVal sender As Object, ByVal e As EventArgs) Handles Me.Load
        If Not Me.IsPostBack Then
            Me.BindGrid()
        End If
    End Sub

    Private Sub BindGrid()
        Dim constr As String = ConfigurationManager.ConnectionStrings("constr").ConnectionString
        Using con As New SqlConnection(constr)
            Using cmd As New SqlCommand("SELECT e.empID, e.empname, e.department, a.managerID, a.status FROM Emp e INNER JOIN Angulers a ON a.empID = e.empID WHERE a.status = 'Done' and e.ManagerID = '"&querystring("ID") & "' and e.department = '"&uerystring("dept") & "' ")
                'We use parametized query to prevent sql injection attack
                '  Dim p1 As New SqlParameter("@dept", Session("dept"))
                'cmd.Parameters.Add(p1)
                Using sda As New SqlDataAdapter()
                    cmd.Connection = con
                    sda.SelectCommand = cmd
                    Using dt As New DataTable()
                        sda.Fill(dt)
                        GridView1.DataSource = dt
                        GridView1.DataBind()
                    End Using
                End Using
            End Using
        End Using
    End Sub

    Protected Sub OnPageIndexChanging(ByVal sender As Object, ByVal e As GridViewPageEventArgs)
        GridView1.PageIndex = e.NewPageIndex
        Me.BindGrid()
End Sub

Thank you in advance

Herman<T>.Instance23-Sep-15 0:24

Herman<T>.Instance

23-Sep-15 0:24

Is this homework?

In Word you can only store 2 bytes. That is why I use Writer.

Re: How to display results based on employees manager and department

Richard Deeming23-Sep-15 1:55

Richard Deeming

23-Sep-15 1:55

Your code is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

VB.NET

Private Sub BindGrid()
    Dim constr As String = ConfigurationManager.ConnectionStrings("constr").ConnectionString
    Using con As New SqlConnection(constr)
        Using cmd As New SqlCommand("SELECT e.empID, e.empname, e.department, a.managerID, a.status FROM Emp e INNER JOIN Angulers a ON a.empID = e.empID WHERE a.status = 'Done' and e.ManagerID = @ManagerID and e.department = @Department")
            cmd.Parameters.AddWithValue("@ManagerID", querystring("ID"))
            cmd.Parameters.AddWithValue("@Department", querystring("dept"))
            
            Using sda As New SqlDataAdapter(cmd)
                Using dt As New DataTable()
                    sda.Fill(dt)
                    GridView1.DataSource = dt
                    GridView1.DataBind()
                End Using
            End Using
        End Using
    End Using
End Sub

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]
SQL injection attack mechanics | Pluralsight [^]

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Re: How to display results based on employees manager and department

samflex23-Sep-15 2:37

Re: How to display results based on employees manager and department

23-Sep-15 2:37

Thank you very much Richard, as always.

You can see that I am actually using parametized query but commented it out just to get the code to work first before using it again.

F-ES Sitecore23-Sep-15 5:56

Re: How to display results based on employees manager and department

23-Sep-15 5:56

You'll need to debug your code, apart from the typo (uerystring("dept")) we don't know what is wrong as we can't run your code in context, we don't know your inputs and we don't know your data. If it "doesn't work" then I suggest you examine the command you are building as querystring("ID") or querystring("dept") might not be what you think they are. If the manager ID is numeric then the issue might be that you're wrapping it in quotes which is only for text

"SELECT e.empID, e.empname, e.department, a.managerID, a.status FROM Emp e INNER JOIN Angulers a ON a.empID = e.empID WHERE a.status = 'Done' and e.ManagerID = "&querystring("ID") & " and e.department = '"&querystring("dept") & "' ")

samflex23-Sep-15 17:36

Re: How to display results based on employees manager and department

23-Sep-15 17:36

I am really sorry guys.

I was showing wrong code.

The correction made by Richard is great and will be used on employeeDetails.aspx page.

However, where my issue lies on the current page.

We would like to show all records related to a department to be displayed when the manager of that department logs on to that page.

As a result, I am trying to use the managerId and department to filter the records.

I am trying to hide the managerId and department Id on the markup but use them to filter the records.

Currently, I am using just the department. If it works, I will add the manager but the department is not working.

Here is the department that I added to the gridview:

XML

<asp:BoundField DataField="department">
 <ItemStyle CssClass="dhide"/>

XML

<asp:BoundField DataField="department">
 <ItemStyle CssClass="dhide"/>

and I want to pass the value to the SELECT statement on codebehind.

Any ideas how to do this?

I will show the code again for clarity with some slight modifications:

XML

<head>
    <style type="text/css">
    .dhide
    {
        display:none;
    }
</style>
</head>
<div align="center">
    <asp:GridView ID="GridView1" runat="server" AutoGenerateColumns="false" AllowPaging="true"
        OnPageIndexChanging="OnPageIndexChanging" PageSize="10">
        <Columns>
             <asp:BoundField DataField="department">
              <ItemStyle CssClass="dhide"/>
              <asp:HyperLinkField DataNavigateUrlFields="ManagerID,department"
                DataNavigateUrlFormatString="employeeDetails.aspx?ID={0}&Dept={1}" Text="Add Comments" />
            <asp:BoundField ItemStyle-Width="200px" DataField="empname" HeaderText="Employee Name" />
            <asp:BoundField ItemStyle-Width="250px" DataField="department" HeaderText="Department" />
         </Columns>
    </asp:GridView>
</div>

'//Code behind:
<pre>    Inherits System.Web.UI.Page
    Protected Sub Page_Load(ByVal sender As Object, ByVal e As EventArgs) Handles Me.Load
        If Not Me.IsPostBack Then
            Me.BindGrid()
        End If
    End Sub
 
    Private Sub BindGrid()
        Dim constr As String = ConfigurationManager.ConnectionStrings("constr").ConnectionString
        Using con As New SqlConnection(constr)
            Using cmd As New SqlCommand("SELECT e.empID, e.empname, e.department, a.managerID, a.status FROM Emp e INNER JOIN Angulers a ON a.empID = e.empID WHERE a.status = 'Done' and e.ManagerID = '"&querystring("ID") & "' and e.department = '"&uerystring("dept") & "' ")
                'We use parametized query to prevent sql injection attack
                '  Dim p1 As New SqlParameter("@dept", Session("dept"))
                'cmd.Parameters.Add(p1)
                Using sda As New SqlDataAdapter()
                    cmd.Connection = con
                    sda.SelectCommand = cmd
                    Using dt As New DataTable()
                        sda.Fill(dt)
                        GridView1.DataSource = dt
                        GridView1.DataBind()
                    End Using
                End Using
            End Using
        End Using
    End Sub

F-ES Sitecore23-Sep-15 21:57

Re: How to display results based on employees manager and department

23-Sep-15 21:57

Any data you want to store and get back on postback but you don't need to be a visible or editable field can be stored in the ViewState.

ViewState["DepID"] = id;

to read it after postback

int id = (int)ViewState["DepID"];

samflex24-Sep-15 3:42

Re: How to display results based on employees manager and department

24-Sep-15 3:42

My question though is how do I grab the value of the following and:

XML

    <style type="text/css">
    .dhide
    {
        display:none;
    }
</style>
<asp:BoundField DataField="department">
 <ItemStyle CssClass="dhide"/>
</asp:BoundField>

and pass it to the SELECT query on the BindGrid sub in codebehind and use it as filter like WHERE e.department = the value of dhide

How do I do that?

F-ES Sitecore24-Sep-15 3:48

How to open javasript pop on button click

24-Sep-15 3:48

I never use binding like that I'm afraid, however rather than using a datagrid to "store" data (something you see a lot of) you should remember that it is simply there to *display* data. The grid is simply being bound to a datasource and if you want to read values then you should read them direct from the datasource you are binding the grid too rather than the grid itself.

It might be advisable to leave datagrids etc behind and use more basic mechanism like repeaters etc, and using the code-behind to bind your data rather than using auto-bound template fields. You end up with greater control over things.

Member 1200294722-Sep-15 1:34

Member 12002947

22-Sep-15 1:34

Hi!

I was trying to open a Javascript pop up on click of button. Though I am able to open the pop up, but my problem is it does not file the onlclick event of the button.

---code for opening the pop up-----

XML

<a href="#"  title="Edit" style=" background-color:#FFF;" data-toggle="modal" data-target="#myModal1"  style="background-color:#FFF;">
                    <asp:ImageButton id="imgedit" runat="server" ImageUrl="boot/img/pen2.png" CommandName="BtnEdit" style="width:20px; height:20px;"/></a>

------------------------------
My above code opens up the popup but the code written behind onclick event is not firing.

Please suggest how I can make my click event work and open the javascript popup

Thanks & Regards

Re: How to open javasript pop on button click

JHizzle22-Sep-15 2:47

JHizzle

22-Sep-15 2:47

You've got no onclick event on the imagebutton itself. Easiest way is to double click it in your VS designer as this'll generate the blank method for you and put you into the .cs/.vb/.whatever codebehind you're using.

Downside: It'll postback your page which should stop your popup. What are you trying to achieve exactly?

Re: How to open javasript pop on button click

F-ES Sitecore22-Sep-15 7:17

Aspdotnet webservice using in HTML with Javascript

22-Sep-15 7:17

You can't really open a pop-up and also do the server-side click event. The javascript click will add a div to the current document, the button click would fire which will trigger a request to your server code, which will run the server-side click event which will result in the document in the browser being replaced with the new document from the server so the div that your js added is now gone. You'll probably need to add code to the server-side click event of your button to create the pop-up when the document has finished rendering.

An Interactive jQuery Modal Popup Control for .NET[^]

J.Ramanjaneyulu21-Sep-15 4:17

J.Ramanjaneyulu

21-Sep-15 4:17

Hello All,

I am new to the web technology, I would like to know, how can i call ASP.net Web Service in a HTML page using java script.
Any sample is appreciated.

Thanks in advance.

Re: Aspdotnet webservice using in HTML with Javascript

Richard MacCutchan21-Sep-15 5:20

Richard MacCutchan

21-Sep-15 5:20

Go to www.asp.net[^] where you will find a wealth of information to get you started.

Re: Aspdotnet webservice using in HTML with Javascript

Blikkies21-Sep-15 19:52

Blikkies

21-Sep-15 19:52

If you have some knowledge of JQuery, you can use the jQuery.ajax() function.

Re: Aspdotnet webservice using in HTML with Javascript

J.Ramanjaneyulu28-Sep-15 15:42

J.Ramanjaneyulu

28-Sep-15 15:42

Hi All,

Thanks for your replies.

Struggled bit to use web service with JavaScript, and we are proceeded with WCF service, and succeeded in consuming the developed WCF service.

Consuming the web service in HTML page with JavaScript is still looking for the solutions.

Thank you.

Re: Aspdotnet webservice using in HTML with Javascript

Blikkies28-Sep-15 19:37

Blikkies

28-Sep-15 19:37

With what are you struggling?

Help .aspx/ going to another page

Member 1199854620-Sep-15 14:44

Member 11998546

20-Sep-15 14:44

Hi Everyone

I am hoping someone can help me out. I have my pages setup as https://domain.com/about.aspx. My site works normal and everything is cool but I was not being indexed by Google. I checked a site and it confirmed I have a url error so when someone types in https://domain.com/about.aspx/
my site comes up with all the images missing but all the text there.

Does anyone know why?? I am assuming the correct response should be a 404 or the aspx work.

Hoping someone can help!
Thanks T

Richard Andrew x6420-Sep-15 15:14

Richard Andrew x64

20-Sep-15 15:14

The server may be returning 404's for the images, but that is not how the browser will render it. It will simply show those placeholder "X" images.

You need to look at the img tags in your about.aspx document and make sure they have the correct URL's.

The difficult we do right away...
...the impossible takes slightly longer.

Member 1199854620-Sep-15 16:28

Member 11998546

20-Sep-15 16:28

Looks like my developer does not have the backslash on the anything so for example /images/image1.png rather images/image1.png. This is for everything not just the images but href, etc..

So to be sure if you go to domain.com/about.aspx/ it should show the .aspx page again and not give a 404??

Thanks T

Richard Andrew x6420-Sep-15 16:33

Richard Andrew x64

20-Sep-15 16:33

Well, if the server is able to locate the "about" document, then it won't give a 404 for it. The server will send the "about" document down to the browser.

However, if the src's for the images don't point to valid image files, then the server won't be able to locate them.

So apparently, the browser is receiving the "about" document but not the images.

The difficult we do right away...
...the impossible takes slightly longer.

modified 20-Sep-15 22:49pm.