Re: parsing - C# Discussion Boards

Re: Best Practice For .NET Service

3-Nov-04 17:17

Because, IIRC, a Sleeping thread won't respond to ANYTHING until it wakes up again. Do you want to wait 30 seconds for the thread to abort, or the service to stop, or its interface to respond, or ... ?

RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

Sebastian Schneider4-Nov-04 22:40

Sebastian Schneider

4-Nov-04 22:40

Exactly.

You cannot wake up a sleeping thread prematurely, so you have to wait for the thread to wake up before you can abort the thread etc.

If you used a timer, you could fire your processing method every 30 seconds and still be able to "fire" it in between conditionally.

e.g. Admin connecting to service, requesting another db-op on the same db with non-standard commands etc.

parsing

webhay3-Nov-04 14:17

3-Nov-04 14:17

hello all

i do this code in db but parse give me this erro "input string not in the correct format" When i leave the field parsed blank (textBox2.text)

"Insert INTO test (Name,age,address) Values('"+textBox1.Text+"','"+decimal.Parse(textBox2.Text)+"','"+textBox3.Text+"

Regards
haytham

Dave Kreskowiak3-Nov-04 17:14

3-Nov-04 17:14

This is what I mean by string concantenation. Don't EVER do this! Use parameterized queries instead. What you doing now results in goofy error you have trouble nailing down and also REALLY opens your code up for SQL injection attacks. For examples, check out the SqlParameter class[^].

RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

Charlie Williams3-Nov-04 17:15

Charlie Williams

3-Nov-04 17:15

The Decimal type can't parse an empty string. It's as invalid a decimal as "Frank" is.

Either make sure you're only dealing with valid values in the TextBox before you parse it or catch the FormatException that will be thrown otherwise. You'll get better performance validating the input, though.

By the way, when Dave Kreskowiak asked you about using string concatenation to build your SQL statement a few posts down, this is what he meant.

A much better way is to use parameters in your query. The exact syntax varies from provider to provider, but here's an example:

// Create the command with place-holders for the parameters
OleDbCommand command = new OleDbCommand("Insert INTO test (Name,age,address) Values(?, ?, ?)");
  
// _name, _age, and _address are variables of the appropriate type that are defined
// and validated elsewhere.  I don't add them straight from 
// the TextBoxes because I don't want junk in my database.
command.Parameters.Add(new OleDbParameter("Name", _name));
command.Parameters.Add(new OleDbParameter("Age", _age));
command.Parameters.Add(new OleDbParameter("Address", _address));

Charlie

if(!curlies){ return; }

webhay4-Nov-04 1:03

4-Nov-04 1:03

Hello Charlie,

Thanks for your help...

i try this code but give the same error

SqlConnection cnn    = new SqlConnection();<br />
			cnn.ConnectionString = "workstation id=SERVER;packet size=4096;integrated security=SSPI;data source=SERVER;persist security info=True;initial catalog=TestDB";<br />
SqlCommand  cmd       = new SqlCommand("Insert INTO test (Name,age,address) Values(@Name,@age,@address)");<br />
			//cmd.CommandType      = CommandType.Text;<br />
			<br />
			cmd.Parameters.Add(new SqlParameter("@Name",SqlDbType.VarChar));<br />
			cmd.Parameters["@Name"].Value = textBox1.Text;<br />
<br />
			cmd.Parameters.Add(new SqlParameter("@age",SqlDbType.Decimal));<br />
			cmd.Parameters["@age"].Value = decimal.Parse(textBox2.Text.Trim());<br />
<br />
			cmd.Parameters.Add(new SqlParameter("@address",SqlDbType.VarChar));<br />
			cmd.Parameters["@address"].Value = textBox3.Text;<br />
	<br />
			<br />
			<br />
			//cmd.CommandText  = "Insert INTO test (Name,age,address) Values(@Name,@age,@address)";<br />
			cnn.Open();<br />
			cmd.ExecuteNonQuery();<br />
			cnn.Close();

please help

Thanks

webhay4-Nov-04 1:03

4-Nov-04 1:03

Hello Charlie,

Thanks for your help...

i try this code but give the same error

SqlConnection cnn    = new SqlConnection();<br />
			cnn.ConnectionString = "workstation id=SERVER;packet size=4096;integrated security=SSPI;data source=SERVER;persist security info=True;initial catalog=TestDB";<br />
SqlCommand  cmd       = new SqlCommand("Insert INTO test (Name,age,address) Values(@Name,@age,@address)");<br />
			//cmd.CommandType      = CommandType.Text;<br />
			<br />
			cmd.Parameters.Add(new SqlParameter("@Name",SqlDbType.VarChar));<br />
			cmd.Parameters["@Name"].Value = textBox1.Text;<br />
<br />
			cmd.Parameters.Add(new SqlParameter("@age",SqlDbType.Decimal));<br />
			cmd.Parameters["@age"].Value = decimal.Parse(textBox2.Text.Trim());<br />
<br />
			cmd.Parameters.Add(new SqlParameter("@address",SqlDbType.VarChar));<br />
			cmd.Parameters["@address"].Value = textBox3.Text;<br />
	<br />
			<br />
			<br />
			//cmd.CommandText  = "Insert INTO test (Name,age,address) Values(@Name,@age,@address)";<br />
			cnn.Open();<br />
			cmd.ExecuteNonQuery();<br />
			cnn.Close();

please help

Thanks

J4amieC4-Nov-04 2:54

J4amieC

4-Nov-04 2:54

you still have the same error in your code:

decimal.Parse(textBox2.Text.Trim());

decimal.Parse will throw a FormatException when the parameter is a blank string. Test for a blank string before the call to this method.

webhay4-Nov-04 3:17

file reading and access database

4-Nov-04 3:17

ok but i need to make some fields require and some fields not require the problem in the fields that not require when the user will leave it blank

how can i solve this problem

regards
Hay

aquahawk3-Nov-04 11:36

aquahawk

3-Nov-04 11:36

what i want to do is read some information from a text file straight into an access database
but i cant find any examples can anyone help with
some code or a site with that information
thx

Re: file reading and access database

HahnTech3-Nov-04 12:09

HahnTech

3-Nov-04 12:09

I'm not sure but access should be able to use the ADO lib's. IF so its jsut a matter of using the ADO conection to insert a string into the Db.
this.SQLConn.ConnectionString = "data source=" + DS + "; initial catalog=Cat"; integrated security=true; persist security info=False; workstation id=" + WorkID + "; packet size=4096";
SQLConn.Open();
if(SQLConn.State == ConnectionState.Open)
{
//insert data
}

As far as reading a file use streamreader http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/frlrfsystemiostreamreaderclassctortopic2.asp[^]

Ronald Hahn, CNT - Computer Engineering Technologist

New Technologies Analyst

HahnTech Affiliated With Code Constructors
Edmonton, Alberta, Canada
Email: rhahn82@telus.net

input string not in a correct format

webhay3-Nov-04 9:24

3-Nov-04 9:24

hi all,

i progarmming a forms that insert data from form to database table and i never do any require field in database or in code but i alwayes have exception "input string not in a correct format" untill i fill all the field required and not required

pleae help

haytham

Jordi Corominas3-Nov-04 10:54

Jordi Corominas

3-Nov-04 10:54

Ara you sure that your sql sentence is well created? It must be a problem in your code, once creating the sql string. I think is not a problem with the DB and the required fields.

Why don't you put a pice of your code (where you create the sql sentence), with this information will be difficult to help you (almost for me Smile | :)

).

Bye!

"Catalonia is not Spain"

Dave Kreskowiak3-Nov-04 11:48

3-Nov-04 11:48

I'll bet money your using string concantenation to build your SQL statement, aren't you?

RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

webhay3-Nov-04 12:01

3-Nov-04 12:01

Hello

Thanks for your reply ...

i am not understand what you mean please make it simply and plz give me example

thanks

Dave Kreskowiak3-Nov-04 17:08

3-Nov-04 17:08

It means you're adding strings together to build an SQL statement. Something like this:

string mySqlStatement = "SELECT * FROM someTable WHERE parm1=" + parm1.ToString() + " AND parm2='" + parm2TextBox.Text + "'"

Don't EVER do this. Use parameterized queries instead.

RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

Jordi Corominas3-Nov-04 21:35

Jordi Corominas

3-Nov-04 21:35

I do always use like this and always works! D'Oh! | :doh:

Why you don't suggest him to do it?

Bye!

"Catalonia is not Spain"

Dave Kreskowiak4-Nov-04 0:57

4-Nov-04 0:57

Sure it works, but it's SO vulnerable it's almost funny! Consider the following code:

// Put together the SQL Statement:
//  SELECT COUNT(*) FROM Users WHERE username=? AND userpass=?
//
string mySQLStatement = "select count(*) from users where userName='" + userName.Text + "' and userPass='" + userPassword.Text + "'"

Now, if the attack enters:

Username: ' OR 1=1 --
Password: anything

The SQL Statement becomes:

SELECT COUNT(*) FROM Users WHERE username='' OR 1=1 --' AND userpass='anything'

Well, in SQL syntax, two consecutive dashes in a row (--) is a comment, just like // is C++ or C# is a comment or ' in VB. So you real SQL statement now looks like:

SELECT COUNT(*) FROM Users WHERE username='' OR 1=1

The result form the SQL statement will always be the number of records in the table, never 0.

Search the web for "SQL Injection Attacks" to find out more and see lots of example of how to break cheap code like this.

RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome