Saving a cloned div into SQL

Question

0.00/5 (No votes)

See more:

I am new to Web Development and am working with C# for Server Side and HTML/CSS/JS/JQuery for Client side. I have a form with multiple fields which upon being submitted saves the data into SQL database. I have used asp.net controls (textboxes, checkboxes etc) because they are easier to access on the server-side using their ids.

For example:

string myEmail1 = txtBxEmail1.Text; (where txtBxEmail is the id of the Text Box)

I am saving the myEmail string into the intended column in my db with a query like:

string query = "insert into My_Table(Email, Phone....) values('"" + myEmail + "','" + myPhone + "','" +......"')";

Now, I have to clone huge chunk of my form to let user add information for a different entity. I was easily able to clone portion of the form using jQuery's Clone method. However the problem is, saving these values into DB.

If anyone could help me understand how to save these cloned values into SQL. Any form of recommendation/direction/snippet would be highly appreciated.

What I have tried:

Since the cloned elements do not have ids initially, I tried to assign incremental ids for them, like txtBxEmail2, txtBxEmail3..... which was the simplest way to go about it, but they do not exist before the program runs so I cannot assign their value into a string like above.

Posted 21-Jan-20 7:24am

Member 14722768

Updated 21-Jan-20 7:54am

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

MadMyche · Answer 1 · 2020-01-21T07:55:00

Welcome to the world of Web Development; hopefully you will enjoy it.

And let's get to best practices right away: this code is vulnerable to SQL Injection. Whenever you are going to take user information and place it into a database you should be using Parameters; and not piecing together an SQL command mixed with the user input.

This is the vulnerable line

C#

string query = "insert into My_Table(Email, Phone....) values('"" + myEmail + "','" + myPhone + "','" +......"')";

The easy way to avoid this problem is adding your variables to the SqlCommand objects Parameter collection:

C#

string query = "INSERT My_Table(Email, Phone....) VALUES (@Email, @Phone,....)";

SqlCommand cmd = new SqlCommand(query, connection);
cmd.Parameters.AddWithValue("@Email", myEmail);
cmd.Parameters.AddWithValue("@Phone", myPhone);
// continue for all your dots (....)

Now for the problem you came here with... I would recommend updating your question with the Improve Question widget and add in the relevant code pieces; otherwise it is going to be a lot of guesswork for the community.

What you yourself can do is troubleshot & debug. Run the program locally in debug mode and step through the POST action you have; this will help identify what the cloned elements are named, so that you can get the values.

Another tool to use is the browser's developer tools. You can "inspect" any element in the DOM to get the element type as well as it's attribute. There is also a network tab in those tools which will allow you to see the post contents being sent when the form is submitted.