Click here to Skip to main content
15,895,746 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
using System;
using System.Collections.Generic;
using System.Data;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;

namespace WEBUI.Forms
{
public partial class StockReports : System.Web.UI.Page
{
DataTable lDt;
protected void Page_Load(object sender, EventArgs e)
{
if(!IsPostBack)
{
fillgalarycombo();
}

}

private void BindGrid()
{
lDt = new DataTable();
DL.clsDB clsDB = new DL.clsDB();
//lDt = clsDB.GetDataSet("EXEC USP_POS_DateWiseStockCB_ReportAll '" +
// clsGlobals.gSecurityObject.FinCd +
// "','" + clsGlobals.gSecurityObject.CompCd +
// "','" + Convert.ToDateTime(dtpFromDate.Text).ToString("yyyy-MM-dd") +
// "','" + Convert.ToDateTime(dtpToDate.Text).ToString("yyyy-MM-dd") +
// "','" + gallery +
// "' ", CommandType.Text).Tables[0];
lDt = clsDB.GetDataSet("EXEC USP_POS_DateWiseStockCB_ReportAll '" +
'5' +
"','" +"12" +
"','" + Convert.ToDateTime("01/03/2015").ToString("yyyy-MM-dd") +
"','" + Convert.ToDateTime("23/03/2015").ToString("yyyy-MM-dd") +
"','" + "0" +
"' ", CommandType.Text).Tables[0];
GridView1.DataSource = lDt;
GridView1.DataBind();
}

private void fillgalarycombo()
{
DataTable lDt = new DataTable();
DL.clsDB clsDB = new DL.clsDB();

try
{

//lDt = clsDB.GetDataSet("Exec GetUnitName '" +
// Convert.ToString(CommonClasses.clsGlobals.gSecurityObject.CompCd) +
// "'", CommandType.Text).Tables[0];
lDt = clsDB.GetDataSet("Exec GetUnitName '" +
Convert.ToString("12") +
"'", CommandType.Text).Tables[0];
System.Data.DataRow dr;
dr = lDt.NewRow();
dr[0] = "All";
dr[1] = "0";
lDt.Rows.InsertAt(dr, 0);
cmbGallery.DataSource = lDt;
cmbGallery.DataTextField= lDt.Columns[0].ColumnName.ToString();
cmbGallery.DataValueField = lDt.Columns[1].ColumnName.ToString();
cmbGallery.DataBind();

}
catch { }

}

protected void CmbRefresh_Click(object sender, EventArgs e)
{
BindGrid();
}

protected void GridView1_PageIndexChanging(object sender, GridViewPageEventArgs e)
{
GridView1.PageIndex = e.NewPageIndex;
BindGrid();
}

protected void Unnamed_Click(object sender, EventArgs e)
{
DL.clsDB clsDB = new DL.clsDB();
lDt = clsDB.GetDataSet("EXEC USP_POS_DateWiseStockCB_ReportAll '" +
'5' +
"','" + "12" +
"','" + Convert.ToDateTime("01/03/2015").ToString("yyyy-MM-dd") +
"','" + Convert.ToDateTime("23/03/2015").ToString("yyyy-MM-dd") +
"','" + "0" +
"' ", CommandType.Text).Tables[0];
DataView DV = new DataView(lDt);
DV.RowFilter = "Gallery Name = '" + mm.Text.Trim() + "'";
GridView1.DataSource = DV;
GridView1.DataBind();
}


}

}
Posted
Comments
Richard Deeming 23-Mar-15 16:33pm    
As Ryan said, your code is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

If your custom clsDB class doesn't allow you to pass parameters, then find the person who wrote it and beat them around the head until they fix the problem. :)

1 solution

1. Don't post extra code that is not relevant.
2. When you have an error, point out exactly where it is, which line of code.
3. I see you have "Gallery Name = '" + mm.Text.Trim() + "'"; I suppose Gallery Name is a field name? If so, you need to put it in brackets. [Gallery Name]. Also, you'll want to research Sql injection and change your code to use Parameters so you do not have unsafe code.
 
Share this answer
 
Comments
atuk2308 23-Mar-15 15:46pm    
Thanks #Ryan Dev. It Works.....
ZurdoDev 23-Mar-15 15:47pm    
Glad to hear it.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900