|
PIEBALDconsult wrote: Don't assume the value came from an untrusted source.
It's safer to assume it is untrusted...
|
|
|
|
|
|
PIEBALDconsult wrote: No it isn't.
Why not? There are plenty of idiots out there...
|
|
|
|
|
It's never a good idea to trust ANY data comming into your app, even if it IS from a trusted source. The data can be corrupted by the time it reaches your validation code.
Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007
|
|
|
|
|
But why assume in this case that the data is "coming into" the application?
He could very well be using
string userName=System.Security.Principal.WindowsIdentity.GetCurrent().Name
or otherwise validating the value.
|
|
|
|
|
True. It doesn't make it 100% valid though. What if the app was run using RunAs, but without the new users profile? Suddenly, the profile path doesn't point to where the userId says it should. Making an assumption like that can also cause problems.
Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007
|
|
|
|
|
Well, my point is that using a parameter doesn't guarantee safety, only validation of the string will do that.
Even if his snippet said ... "SELECT * FROM Y WHERE X=" + textbox1.Text ..." ... I'd still not assume that proper validation wasn't performed outside the snippet.
|
|
|
|
|
It would appear that you missed this part of my previous post:
... The data can be corrupted by the time it reaches your validation code.
Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007
|
|
|
|
|
That's why we have validation code.
Now, if the data gets corrupted after the validation code...
|
|
|
|
|
You can only do so much without resorting to specialized hardware.
Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007
|
|
|
|
|
Can you tell me how can I select the rows to delete?
I'm sorry. I'm newbie.
--
Adrián Córdoba
|
|
|
|
|
You need to set the Commands.
|
|
|
|
|
The commands were automaticaly generated by Visual Studio 2005 in the moment of insert the DataSet.
--
Adrián Córdoba
|
|
|
|
|
But they're in the original TableAdapter. When you do
DataSetTableAdapters.UsersTableAdapter usersTableAdapter = new DataSetTableAdapters.UsersTableAdapter();
you instantiate a new/uninitialized TableAdapter.
|
|
|
|
|
PIEBALDconsult wrote: You need to set the Commands.
You are right.
Visual Studio 2005 didn't generate the DeleteCommand, seemingly because the Users table in database hasn't a Primary Key.
I added a Primary Key to the table, and when I added this table to the DataSet the DeleteCommand was automaticaly generated.
Thank you very much.
--
Adrián Córdoba
|
|
|
|
|
First off do you have your update command made yet?
I'll I know how to do with DataAdapters is the sql part of them, but if thats what your doing here is an example. It should be kinda the same type of thing.
<cod>
SqlConnection CNN = new SqlConnection("Data Source=(local);Initial Catalog=Northwind;Integrated Security=true");
SqlDataAdapter DA = new SqlDataAdapter();
DataSet DS = new DataSet();
SqlCommand cmdSelect = CNN.CreateCommand();
cmdSelect.CommandText = "Select CustomerID, ContactName, CompanyName From Customers";
// create an Update command
SqlCommand cmdUpdate = CNN.CreateCommand();
cmdUpdate.CommandText = "Update Customers SET CompanyName=@CompanyName, ContactName=@ContactName WHERE CustomerID=@CustomerID";
cmdUpdate.Parameters.Add("@CompanyName",
SqlDbType.NVarChar, 40, "CompanyName");
cmdUpdate.Parameters.Add("@ContactName",
SqlDbType.NVarChar, 30, "ContactName");
cmdUpdate.Parameters.Add("@CustomerID",
SqlDbType.NChar, 5, "CustomerID");
cmdUpdate.Parameters["@CustomerID"].SourceVersion =
DataRowVersion.Original;
// create an Insert command
SqlCommand cmdInsert = CNN.CreateCommand();
cmdInsert.CommandText =
"Insert into customers (customerid, companyname, contactname) Values (@customerid, @companyname, @contactname)";
cmdInsert.Parameters.Add("@customerid",
SqlDbType.NChar, 5, "customerid");
cmdInsert.Parameters.Add("@companyname",
SqlDbType.NVarChar, 40, "companyname");
cmdInsert.Parameters.Add("@contactname",
SqlDbType.NVarChar, 30, "contactname");
cmdInsert.Parameters["@customerid"].SourceVersion =
DataRowVersion.Original;
// create a Delete command
SqlCommand cmdDelete = CNN.CreateCommand();
cmdDelete.CommandText = "Delete from customers Where customerid = @customerid";
cmdDelete.Parameters.Add("@customerid",
SqlDbType.NChar, 5, "customerid");
cmdDelete.Parameters["@customerid"].SourceVersion =
DataRowVersion.Original;
DA.SelectCommand = cmdSelect;
DA.UpdateCommand = cmdUpdate;
DA.InsertCommand = cmdInsert;
DA.DeleteCommand = cmdDelete;
DA.Fill(DS, "Customers");
//then do whatever you want to with modifying it.
//And then just do update like this
DA.Update(DS, "Customers");
Castro
|
|
|
|
|
Hello Friends,
I am a beginner in C# programming, I am trying to build a small home based expense management tool in which i need to login to my acct on different banking websites to get the bills/pay the bills through my tool. I believe this is possible through the web services provided by those banks(if not plz correct me).
My question is how do i find out those web services?
Thanks in advance,
Anitha
|
|
|
|
|
Odds are very high that those web services do not exist. You should ask the banks in question.
Christian Graus - Microsoft MVP - C++
Metal Musings - Rex and my new metal blog
"I am working on a project that will convert a FORTRAN code to corresponding C++ code.I am not aware of FORTRAN syntax" ( spotted in the C++/CLI forum )
|
|
|
|
|
Any other way to do this?
|
|
|
|
|
Not without spending a ton of money, or doing it the very tedious way.
The money would be spent on the access to the banking system and the API's to interact with it. It's not very likely you'll ever get that...
The tedious way is to write code to load and parse the web pages from the banking sites, including code to login to those sites. Like I said, this is VERY tedious work because you'll have to custom write code for each and every website and each and every page to get the information you want. The other big downside to doing this is when, not if, the bank changes their website, you'll have to go back and rewrite your code to parse up the new pages.
Dave Kreskowiak
Microsoft MVP
Visual Developer - Visual Basic
2006, 2007
|
|
|
|
|
I have searched and searched and have found nothing that will help me. I have a formatted file to send to a printer. I have to do it this way because I can't print straight from the program (AutoCAD) to a printer, so I have to print to a file. I can do this just fine, but I can't see how to copy the .plt files to the printer port.
This is just my thinking (copy the file to the printer through the printer port), if I'm wrong please point me in the right direction.
Thanks in advance.
Tim
|
|
|
|
|
You would be able to just make a console app and use the built in printer class. It should do the trick. I don't know for sure, so sorry.
Castro
|
|
|
|
|
Thanks for the idea. I will see what I can do.
Tim
|
|
|
|
|
Hi,
I want to create an application that plays the sound recorded from the microphone. I succeeded in capturing the sound from the mic using CaptureBuffer....my problem is when using the data from this buffer to play it with SecondaryBuffer.
I'm using a memory stream to get the data from the capture buffer to a stream. When I capture the data from the mic I use the following code.
CaptureData is a byte array.
<br />
memStream.Write(CaptureData, 0, CaptureData.Length);<br />
secBuffer = new SecondaryBuffer(memStream, appDevice);<br />
secBuffer.Play(0, BufferPlayFlags.Default);<br />
When i run my application it gives me System.ArgumentException was unhandled - Value does not fall within the expected range.
Even if I use a different constructor, it always gives me this exception. I think it' because of the device object...This object is instantiated like this:
<br />
appDevice = new Device();<br />
appDevice.SetCooperativeLevel(this, CooperativeLevel.Priority);<br />
If any of you have a suggestion it will be most welcomed because I ran out of ideas.
Thanks.
Do your best to be the best
|
|
|
|
|
Maybe you should use the constructor where you pass in a BufferDescription object to describe the format you're using. This is just a guess, but I think that since you got your stream for a capture buffer that it's not going to have the headers at the beginning that a stream loaded directly from a wave file would have. Thus you need to provide that info with the BufferDescription object.
But don't quote me on that...
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
