Click here to Skip to main content
15,888,968 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
Hi
I'm new to web development. I'm creating a new web application using asp.net and VB.net.

in the page i'm working with there is some fields but what i'm concerned about is i added code using Javascript to add and remove items from and to list box. values are coming from a dropdownlist.

but when i run the code behind to add the listbox items to db it always gives me "index is out of range" although there more than 2 items.

I really need your help.

Thanks.

What I have tried:

The VB codebehind is : error is raised in the for loop.

VB
Private Sub CmdSave_Click(sender As Object, e As EventArgs) Handles CmdSave.Click
        Try
            If RecSet.State = 1 Then RecSet.Close()
            SQL1 = "SELECT * FROM REF_Committees WHERE CommitteeId = " & Trim(TxtId.Text)
            RecSet.Open(SQL1, Conn, ADODB.CursorTypeEnum.adOpenKeyset)
            If Not RecSet.EOF Then
                SQL1 = "DELETE FROM REF_Committees WHERE CommitteeId = " & Trim(TxtId.Text) : Conn.Execute(SQL1)
            End If
            'GET VARIABLES
            Call GetValues(2) : Call GetValues(3)
            'INSERT RECORD
            SQL1 = "INSERT INTO REF_Committees VALUES ("
            SQL1 = SQL1 & Trim(TxtId.Text) & ",'" & Trim(TxtDesc.Text) & "','False'," & YearIdVar & "," & SemesterIdVar & ",'True','True'," & Application("SysUserIdVar") & ",'"
            SQL1 = SQL1 & Format(DateValue(Now.Date), "MM/dd/yyyy") & " " & Format(TimeValue(TimeOfDay), "hh:mm:ss tt") & "')"
            Conn.Execute(SQL1)
            Dim i As Integer = 0
            For i = 0 To LstMembers.Rows - 1
                If RecSet.State = 1 Then RecSet.Close()
                LstMembers.SelectedIndex = i : LstTitles.SelectedIndex = i
                SQL1 = "SELECT MemberId FROM REF_Members WHERE MemberDesc = '" & LstMembers.SelectedItem.Text & "'"
                RecSet.Open(SQL1, Conn, ADODB.CursorTypeEnum.adOpenKeyset)
                If Not RecSet.EOF Then
                    SQL1 = "INSERT INTO REF_Committees_Mem VALUES ("
                    SQL1 = SQL1 & Trim(TxtId.Text) & "," & RecSet(0).Value & ",'" & LstTitles.SelectedItem.Text & "','True','True'," & Application("SysUserIdVar") & ",'"
                    SQL1 = SQL1 & Format(DateValue(Now.Date), "MM/dd/yyyy") & " " & Format(TimeValue(TimeOfDay), "hh:mm:ss tt") & "')"
                    Conn.Execute(SQL1)
                End If
            Next
            Call CleanScreen()
        Catch ex As Exception

        End Try
    End Sub()

Javascript to add and remove items is :


        function AddMember() {
            var txtValue = document.getElementById("");
            var listBox = document.getElementById("");
            var option = document.createElement("OPTION");
            option.innerHTML = txtValue.value;
            option.value = txtValue.value;   
            var i;
            for (i = listBox.options.length - 1; i >= 0; i--) {
                if (listBox.options[i].value == txtValue.value) {
                    alert("This Member Is Already In The List");
                    return false;
                }
            }
            listBox.appendChild(option);
            txtValue.value = "";
            return AddTitle();
            return false;
        }
        function AddTitle() {
            var txtValue = document.getElementById("");
            var listBox = document.getElementById("");
            var option = document.createElement("OPTION");
            option.innerHTML = txtValue.value;
            option.value = txtValue.value;
            listBox.appendChild(option);
            txtValue.value = "";
            return false;
        }
        function DeleteMember() {
            var MemberList = document.getElementById("");
            var TitlesList = document.getElementById("");
            var i;
            for (i = MemberList.options.length - 1; i >= 0; i--) {
                if (MemberList.options[i].selected == true) {
                    MemberList.remove(i);
                    TitlesList.remove(i);
                }
            }
            return;
        }
Posted
Updated 21-Mar-18 0:47am
v2
Comments
Richard Deeming 21-Mar-18 17:44pm    
Since you're using .NET, you should abandon the ancient and long-dead "classic" ADO, and switch to ADO.NET[^] instead.

1 solution

This is going to depend heavily on your data - which we have no access to at all. And taht means we can't do much for you, if anything.

So, it's going to be up to you.
Fortunately, you have a tool available to you which will help you find out what is going on: the debugger. How you use it depends on your compiler system, but a quick Google for the name of your IDE and "debugger" should give you the info you need.

Put a breakpoint on the first line in the function, and run your code through the debugger. Then look at your code, and at your data and work out what should happen manually. Then single step each line checking that what you expected to happen is exactly what did. When it isn't, that's when you have a problem, and you can back-track (or run it again and look more closely) to find out why.

Sorry, but we can't do that for you - time for you to learn a new (and very, very useful) skill: debugging!


And do yourself a big favour: Don't do database code like that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
SQL
DROP TABLE MyTable;
A perfectly valid "delete the table" command
SQL
--'
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?
 
Share this answer
 
v2

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900