Click here to Skip to main content
15,891,136 members
Home / Discussions / ASP.NET
   

ASP.NET

 
QuestionMSchart isn't show completely Pin
Member 1154563919-Nov-15 0:19
Member 1154563919-Nov-15 0:19 
AnswerRe: MSchart isn't show completely Pin
ZurdoDev23-Nov-15 3:00
professionalZurdoDev23-Nov-15 3:00 
QuestionMVC Forum ? Pin
John C Rayan17-Nov-15 1:20
professionalJohn C Rayan17-Nov-15 1:20 
AnswerRe: MVC Forum ? Pin
ZurdoDev23-Nov-15 3:00
professionalZurdoDev23-Nov-15 3:00 
GeneralRe: MVC Forum ? Pin
John C Rayan23-Nov-15 22:26
professionalJohn C Rayan23-Nov-15 22:26 
QuestionDetailsview InsertItem Pin
tiwal15-Nov-15 23:08
tiwal15-Nov-15 23:08 
AnswerRe: Detailsview InsertItem Pin
tiwal15-Nov-15 23:20
tiwal15-Nov-15 23:20 
SuggestionRe: Detailsview InsertItem Pin
Richard Deeming16-Nov-15 2:56
mveRichard Deeming16-Nov-15 2:56 
Your code is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]
SQL injection attack mechanics | Pluralsight [^]

C#
protected void DetailsView1_ItemInserting(object sender, DetailsViewInsertEventArgs e)
{
    string ConnStr = WebConfigurationManager.ConnectionStrings[CONNECTION].ConnectionString;

    using (SqlConnection connection = new SqlConnection(ConnStr))
    using (SqlCommand command = new SqlCommand("", connection))
    {
        string[] columns = new string[e.Values.Count];
        int index = 0;

        foreach (string key in e.Values.Keys)
        {
            command.Parameters.AddWithValue("@" + key, e.Values[key]);
            columns[index] = key;
            index++;
        }

        command.CommandText = string.Format("INSERT INTO [{0}] ({1}) VALUES (@{2})",
            TABLE, string.Join(", ", columns), string.Join(", @", columns));

        connection.Open();
        command.ExecuteNonQuery();
    }

    Server.Transfer("~/modifica.aspx");
}




"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer


QuestionASP.NET Pin
Member 1214037915-Nov-15 4:09
Member 1214037915-Nov-15 4:09 
AnswerRe: ASP.NET Pin
Afzaal Ahmad Zeeshan15-Nov-15 23:57
professionalAfzaal Ahmad Zeeshan15-Nov-15 23:57 
AnswerRe: ASP.NET Pin
ZurdoDev16-Nov-15 2:20
professionalZurdoDev16-Nov-15 2:20 
Questionasp.net Pin
Member 1214037915-Nov-15 3:51
Member 1214037915-Nov-15 3:51 
AnswerRe: asp.net Pin
Afzaal Ahmad Zeeshan15-Nov-15 23:58
professionalAfzaal Ahmad Zeeshan15-Nov-15 23:58 
AnswerRe: asp.net Pin
ZurdoDev16-Nov-15 2:21
professionalZurdoDev16-Nov-15 2:21 
QuestionGridview with full-screen editing question Pin
Member 1044208512-Nov-15 7:53
Member 1044208512-Nov-15 7:53 
AnswerRe: Gridview with full-screen editing question Pin
Mathi Mani12-Nov-15 8:18
Mathi Mani12-Nov-15 8:18 
GeneralRe: Gridview with full-screen editing question Pin
Member 1044208512-Nov-15 9:08
Member 1044208512-Nov-15 9:08 
QuestionHelp with a connection string Pin
Member 121243549-Nov-15 13:50
Member 121243549-Nov-15 13:50 
AnswerRe: Help with a connection string Pin
Wombaticus10-Nov-15 1:09
Wombaticus10-Nov-15 1:09 
AnswerRe: Help with a connection string Pin
Richard Deeming10-Nov-15 1:21
mveRichard Deeming10-Nov-15 1:21 
GeneralRe: Help with a connection string Pin
Member 1212435410-Nov-15 12:28
Member 1212435410-Nov-15 12:28 
GeneralRe: Help with a connection string Pin
Richard Deeming11-Nov-15 1:54
mveRichard Deeming11-Nov-15 1:54 
GeneralRe: Help with a connection string Pin
Member 1212435411-Nov-15 11:59
Member 1212435411-Nov-15 11:59 
QuestionJquery Ajax method call with asp.net static webmethods Pin
ganesh.dks8-Nov-15 20:31
ganesh.dks8-Nov-15 20:31 
AnswerRe: Jquery Ajax method call with asp.net static webmethods Pin
Nathan Minier9-Nov-15 2:53
professionalNathan Minier9-Nov-15 2:53 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.