.NET (Core and Framework)

15-Feb-14 23:33

CaseLost wrote:
'im try to just show the table "inventory" in the form when you click on the sub-menu
'what do I have to write on here?

Depends on what you want to do with that data. If you have a datagridview, you could load the data and assign it to it's datasource-property.

CaseLost wrote:
how do you write the code to show only "Inventory" (from the database) in the
form?

Not so fast; you'll need something to display it ON; a form, a grid, labels. Then you'll need to load your data (using SQL, restricting the data using a WHERE clause). After that, you can put your data on that form and display it.

If you haven't displayed anything from a database before, I suggest you put this project on hold and try some examples first. There's an example here[^] Smile | :)

Bastard Programmer from Hell Suspicious | :suss:

If you can't read my code, try converting it here[^]

sql query syntax in .net

Member 1050621512-Feb-14 3:52

12-Feb-14 3:52

Hello guys.i need help with this query. i am not very good at this kind of query.
wh is wrong with it? missing ant ) or ' ?
Hereis my code:

strsql = "update membercars set "
                strsql = strsql & "make= '" & txtmake.Text & "', "
                strsql = strsql & "model= '" & txtmodel.Text & "', "
                strsql = strsql & "color= '" & txtcolor.Text & "', "
                strsql = strsql & "tag= '" & txttag.Text & "', "
                strsql = strsql & "memberid= " & Val(txtserial.Text) & " where serial = " & Val(txtcarserial.Text)

                strsql = strsql & " and serial = " & Val(txtserial.Text) & ") "

Dave Kreskowiak12-Feb-14 4:30

Dave Kreskowiak

12-Feb-14 4:30

EVERYTHING is wrong with it.

Google for "SQL Injection attack" to find out why what you're doing is wrong and then Google for "C# parameterized queries" for all kinds of examples on how to build your query without using string concatenation.

Oh, and you have a closing ")", but no opening "(".

A guide to posting questions on CodeProject[^]

Dave Kreskowiak

thatraja12-Feb-14 4:31

thatraja

12-Feb-14 4:31

You have added an unwanted closing paranthesis at end(last line), remove that.

And your query/code is poorly format, bad practices & not secure one. Use parametrized queries. Check these
Using parameterized SQL queries[^]
Give me parameterized SQL, or give me death[^]

thatraja

Code converters | Education Needed
No thanks, I am all stocked up. - Luc Pattyn
When you're wrestling a gorilla, you don't stop when you're tired, you stop when the gorilla is - Henry Minute

Richard Deeming12-Feb-14 5:22

Richard Deeming

12-Feb-14 5:22

Here's another SQL Injection reference, in case you weren't convinced by the other messages:
http://www.troyhunt.com/2013/07/everything-you-wanted-to-know-about-sql.html[^]

To fix your code:

SQL

command.CommandText = "update membercars set make = @make, model = @model, color = @color, tag = @tag, memberid = @memberid where serial = @serial";
command.Parameters.AddWithValue("@make", txtmake.Text)
command.Parameters.AddWithValue("@model", txtmodel.Text)
command.Parameters.AddWithValue("@color", txtcolor.Text)
command.Parameters.AddWithValue("@tag", txttag.Text)
command.Parameters.AddWithValue("@memberid", txtserial.Text)
command.Parameters.AddWithValue("@serial", txtcarserial.Text)

"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer

Eddy Vluggen12-Feb-14 6:56

12-Feb-14 6:56

This is your query btw (changed layout for readabillity);

SQL

update membercars 
   set make= '1'
     , model= 'super'
     , color= 'green'
     , tag= 'Youre it!'
     , memberid= txtserial
 where serial = txtcarserial
   and serial = txtserial

If txtcarserial and txtserial do not match, no records will be returned. The SQL query syntax is the same, regardless of the calling language.

Bastard Programmer from Hell Suspicious | :suss:

If you can't read my code, try converting it here[^]

Member 1050621512-Feb-14 22:01

12-Feb-14 22:01

Thank you so much guys. It worked and it's much easier than the method that i wrote before.

cmd.Connection = mcon
              cmd.CommandText = "update membercars set make=@make, model=@model, color=@color, tag= @tag where memberid=@memberid;"
              cmd.Parameters.AddWithValue("@make", txtmake.Text)
              cmd.Parameters.AddWithValue("@model", txtmodel.Text)
              cmd.Parameters.AddWithValue("@color", txtcolor.Text)
              cmd.Parameters.AddWithValue("@tag", txttag.Text)
              cmd.Parameters.AddWithValue("@memberid", txtserial.Text)
              cmd.ExecuteNonQuery()

Just one more question. I am writing an insert query.

cmd.CommandText = "insert into membercars(make, model, plate, color, tag) values (@make, @model, @plate, @color, @tag) where memberid=@memberid;"
      cmd.Parameters.AddWithValue("@make", txtmake.Text)
      cmd.Parameters.AddWithValue("@model", txtmodel.Text)
      cmd.Parameters.AddWithValue("@plate", txtplate.Text)
      cmd.Parameters.AddWithValue("@color", txtcolor.Text)
      cmd.Parameters.AddWithValue("@tag", txttag.Text)
      cmd.Parameters.AddWithValue("@memberid", txtserial.Text)
      cmd.ExecuteNonQuery()

it's giving me an eror: incorrect syntax near where. what's the error?

Eddy Vluggen12-Feb-14 22:28

12-Feb-14 22:28

Member 10506215 wrote:
what's the error?

An INSERT does not contain a WHERE-clause. What would/should the "where" do? Syntax can be found here[^].

Get a good book on SQL; this looks like trial and error.

Bastard Programmer from Hell Suspicious | :suss:

If you can't read my code, try converting it here[^]

Member 1050621512-Feb-14 22:35

12-Feb-14 22:35

i'll tell you the details.
i have 2 tables: members and membercars. i need to be able to add more than one car for one member. so i thought if i added the second car, and i put a condition--where memberid=txtserial.text--the memberid is for the membercars and the txtserial.text is the serial for a member(autincremented).
So any suggestions?

Eddy Vluggen13-Feb-14 0:31

13-Feb-14 0:31

You can't use the "where" clause in an insert. The computer will simply not accept it, regardless of your intention. (Yes, it does accept it in a subselect, but that is not the case here)

CAR
carId

PERSON
personId

CAROWNERS
carId
personId

Or, with data;

CAR
12
14
167

PERSON
A
B
C

CAROWNERS
12, A
167, A
14, B

If you want to register a car to a person, insert a record into "CAROWNERS" containing both Id's.

Member 10506215 wrote:
so i thought if i added the second car, and i put a condition

That's not how it works; commands have a specific syntax, you don't make one up and assume it works.

Get a book on SQL. Get it today, before I see a question on joining those records back together.

Bastard Programmer from Hell Suspicious | :suss:

If you can't read my code, try converting it here[^]

Member 1050621513-Feb-14 1:39

13-Feb-14 1:39

Done

i need to add multiple cars for just one member. Here is my code for saving cars:

Dim cmd As New SqlCommand
        cmd.Connection = mcon
        cmd.CommandText = "insert into membercars(serial, memberid, make, model, plate, color, tag) values (@serial, @memberid, @make, @model, @plate, @color, @tag);"
        cmd.Parameters.AddWithValue("@serial", txtserial.Text)
        cmd.Parameters.AddWithValue("@memberid", txtserial.Text)
        cmd.Parameters.AddWithValue("@make", txtmake.Text)
        cmd.Parameters.AddWithValue("@model", txtmodel.Text)
        cmd.Parameters.AddWithValue("@plate", txtplate.Text)
        cmd.Parameters.AddWithValue("@color", txtcolor.Text)
        cmd.Parameters.AddWithValue("@tag", txttag.Text)
        cmd.ExecuteNonQuery()}
        fillgrid()

And this for saving mambers:

cmd.Connection = mcon
                strsql = "insert into members "
                strsql = strsql & "(name, "
                strsql = strsql & "familyname, "
                strsql = strsql & "address, "
                strsql = strsql & "mobile, "
                strsql = strsql & "phone, "
                strsql = strsql & "fax, "
                strsql = strsql & "email, "
                strsql = strsql & "space, "
                strsql = strsql & "timezone, "
                strsql = strsql & "website) "
                strsql = strsql & "values ('" & txtname.Text & "', "
                strsql = strsql & "'" & txtfamilyname.Text & "', "
                strsql = strsql & "'" & txtaddress.Text & "', "
                strsql = strsql & "'" & txtmobile.Text & "', "
                strsql = strsql & "'" & txtphone.Text & "', "
                strsql = strsql & "'" & txtfax.Text & "', "
                strsql = strsql & "'" & txtemail.Text & "', "
                strsql = strsql & "'" & txtspace.Text & "', "
                strsql = strsql & Val(cmbtimezone.SelectedValue) & ", "
                strsql = strsql & "'" & txtwebsite.Text & "') "
                strsql += " SELECT IDENT_CURRENT('members')"
                ' 'strsql += " SELECT @@IDENTITY;"
                ' '' 
                cmd.CommandText = strsql
                ''cmd.ExecuteNonQuery()
                txtsearch.Text = ""
                txtserial.Text = cmd.ExecuteScalar().ToString()

Thank you for your replies Smile | :)

Eddy Vluggen13-Feb-14 2:59

13-Feb-14 2:59

The first query is a lot safer than your second one; pasting strings together to create a query is a sin.

Any reason why you're not using parameters there like in the first query?

Bastard Programmer from Hell Suspicious | :suss:

If you can't read my code, try converting it here[^]

Member 1050621513-Feb-14 3:48

13-Feb-14 3:48

yes i know.
i tried to do it like this, but i have an error.

Dim cmd As New SqlCommand
       cmd.Connection = mcon
       cmd.CommandText = "insert into members(serial, name, familyname, address, phone, mobile, fax, email, website, space, timezone) values (@serial, @name, @familyname, @address, @phone, @mobile, @fax, @email, @website, @space, @timezone) ;"
       cmd.Parameters.AddWithValue("@serial", txtserial.Text)
       cmd.Parameters.AddWithValue("@name", txtname.Text)
       cmd.Parameters.AddWithValue("@familyname", txtfamilyname.Text)
       cmd.Parameters.AddWithValue("@address", txtaddress.Text)
       cmd.Parameters.AddWithValue("@phone", txtphone.Text)
       cmd.Parameters.AddWithValue("@mobile", txtmobile.Text)
       cmd.Parameters.AddWithValue("@fax", txtfax.Text)
       cmd.Parameters.AddWithValue("@email", txtemail.Text)
       cmd.Parameters.AddWithValue("@website", txtwebsite.Text)
       cmd.Parameters.AddWithValue("@space", txtspace.Text)
       cmd.Parameters.AddWithValue("@timezone", cmbtimezone.Text)
       cmd.ExecuteNonQuery()
       fillgrid()

How am i going to set the identity to txtserial.text? in the parameters method?

Eddy Vluggen13-Feb-14 4:59

Uploading Data from MySql to MS Project using .net C#

13-Feb-14 4:59

Member 10506215 wrote:
How am i going to set the identity to txtserial.text?

You did not set it in the previous query where you concatenate strings. Why would you need to set it now?

The identity is generated by the database at the moment you perform the insert; you don't have to set it. You would like to fetch it - that's what the SELECT IDENT_CURRENT('members') would do.

Stop trying and start reading. If you continue using trial and error, you'll be building some things you're going to regret later.

Bastard Programmer from Hell Suspicious | :suss:

If you can't read my code, try converting it here[^]

Badari Narayan11-Feb-14 21:22

Badari Narayan

11-Feb-14 21:22

Kindly help me by posting the code for uploading data from MySql Database into MSProject using C#.

Thanks and Regards
badarinarayan@live.com

Re: Uploading Data from MySql to MS Project using .net C#

Richard MacCutchan11-Feb-14 21:25

Richard MacCutchan

11-Feb-14 21:25

Kindly read http://www.codeproject.com/Messages/3122367/How-to-get-an-answer-to-your-question.aspx[^].

Veni, vidi, abiit domum

serialport timeout c# .net 4 client profile

openLG11-Feb-14 1:40

openLG

11-Feb-14 1:40

Hello,

I want to read a packet from serial port,
I don't know the length of the packet,
so I have to wait a timeout for the first byte
and then I have to read all next bytes.

I supersed class

SerialPort

and I write the method

Receive

in ".NET Framework 4 Client Profile".

I try to use this code but
sometimes

Receive

works well, sometimes doesn't work

public class PortaCom : SerialPort
    {
        int timeout = 0;
        public PortaCom(string portName, int baudRate, int timeout)
            : base(portName, baudRate)
        {
            this.timeout = timeout;
            base.Open();
        }

        public byte[] Receive()
        {
            List<Byte> ByteList = new List<Byte>();
            DateTime Now = DateTime.Now;
            base.ReadTimeout = 1;//ms
            //wait 1st byte
            //in a timeout span
            int FirstByte = -1;
            while (FirstByte == -1)
            {
                if (DateTime.Now - Now > TimeSpan.FromMilliseconds(timeout))
                    throw new TimeoutException();
                try { FirstByte = base.ReadByte(); }
                catch (TimeoutException) { }
            }
            //read next bytes
            //if available
            int NextByte = FirstByte;
            while (NextByte != -1)
            {
                try
                {
                    Byte _NextByte = (Byte)NextByte;
                    ByteList.Add(_NextByte);
                    NextByte = base.ReadByte();
                }
                catch (TimeoutException)
                {
                    return ByteList.ToArray();
                }                
            }
            return ByteList.ToArray();
        }
}

Can someone help me ?

Re: serialport timeout c# .net 4 client profile

Eddy Vluggen11-Feb-14 3:11