Click here to Skip to main content
15,890,946 members
Home / Discussions / C#
   

C#

 
GeneralRe: getting substring from a string Pin
Manas Bhardwaj8-Jun-07 3:00
professionalManas Bhardwaj8-Jun-07 3:00 
GeneralRe: getting substring from a string Pin
Ankit Aneja8-Jun-07 3:25
Ankit Aneja8-Jun-07 3:25 
GeneralRe: getting substring from a string Pin
Manas Bhardwaj8-Jun-07 3:28
professionalManas Bhardwaj8-Jun-07 3:28 
GeneralRe: getting substring from a string Pin
Ankit Aneja8-Jun-07 5:04
Ankit Aneja8-Jun-07 5:04 
QuestionInsert in Oracle Pin
Walaza8-Jun-07 0:26
Walaza8-Jun-07 0:26 
AnswerRe: Insert in Oracle Pin
Colin Angus Mackay8-Jun-07 0:36
Colin Angus Mackay8-Jun-07 0:36 
GeneralRe: Insert in Oracle Pin
Walaza8-Jun-07 0:46
Walaza8-Jun-07 0:46 
AnswerRe: Insert in Oracle Pin
Colin Angus Mackay8-Jun-07 0:53
Colin Angus Mackay8-Jun-07 0:53 
Walaza wrote:
string strSQL;
string insertValue= "'"+fname+"',"+"'"+lname+"',"+"'"+usrname+"',"+"'"+passwd+"',"+"'"+address+"',"+"'"+email+"',"+"'"+tester_id+"'";

strSQL = " INSERT INTO TESTER (FIRSTNAME, LASTNAME, USRNAME, PASSWD, ADDRESS, EMAIL, TESTERID) VALUES ("+insertValue+")";


This injects the values into the SQL. This is the source of a SQL Injection Attack, so you don't want to be injecting values.


Walaza wrote:
InsertCommand.Parameters.Add(":FIRSTNAME",System.Data.OracleClient.OracleType.VarChar,255);
InsertCommand.Parameters.Add(":LASTNAME",System.Data.OracleClient.OracleType.VarChar,255);
InsertCommand.Parameters.Add(":USRNAME",System.Data.OracleClient.OracleType.VarChar,255);
InsertCommand.Parameters.Add(":PASSWD",System.Data.OracleClient.OracleType.VarChar,255);
InsertCommand.Parameters.Add(":ADDRESS",System.Data.OracleClient.OracleType.VarChar,255);
InsertCommand.Parameters.Add(":EMAIL",System.Data.OracleClient.OracleType.VarChar,255);
InsertCommand.Parameters.Add(":TESTERID",System.Data.OracleClient.OracleType.VarChar,255);


What you want to do is alter the SQL String you've set up so that it doesn't inject values into the string.

So... Change insertValues to be a string that contains the parameter names rather than injecting the actual values. So it reads something like this:
string insertValue= ":FIRSTNAME, :LASTNAME, :USRNAME, :PASSWD, :ADDRESS, "+
                    ":EMAIL, :TESTERID";





Upcoming events:
* Glasgow: Mock Objects, SQL Server CLR Integration, Reporting Services, db4o, Dependency Injection with Spring ...
* Reading: Developer Day 5

Never write for other people. Write for yourself, because you have a passion for it. -- Marc Clifton


My website

QuestionPassing Objects to threads.. Pin
Eytukan8-Jun-07 0:20
Eytukan8-Jun-07 0:20 
AnswerRe: Passing Objects to threads.. Pin
Manas Bhardwaj8-Jun-07 0:24
professionalManas Bhardwaj8-Jun-07 0:24 
GeneralRe: Passing Objects to threads.. Pin
Colin Angus Mackay8-Jun-07 0:34
Colin Angus Mackay8-Jun-07 0:34 
GeneralRe: Passing Objects to threads.. Pin
Manas Bhardwaj8-Jun-07 0:50
professionalManas Bhardwaj8-Jun-07 0:50 
GeneralRe: Passing Objects to threads.. Pin
Colin Angus Mackay8-Jun-07 0:55
Colin Angus Mackay8-Jun-07 0:55 
GeneralRe: Passing Objects to threads.. Pin
Manas Bhardwaj8-Jun-07 1:03
professionalManas Bhardwaj8-Jun-07 1:03 
GeneralRe: Passing Objects to threads.. Pin
AikinX8-Jun-07 0:55
AikinX8-Jun-07 0:55 
AnswerRe: Passing Objects to threads.. Pin
andre_swnpl8-Jun-07 1:37
andre_swnpl8-Jun-07 1:37 
Questionconvert this cyrillic output from the console app to unicode [modified] Pin
drweb868-Jun-07 0:00
drweb868-Jun-07 0:00 
AnswerRe: convert this cyrillic output from the console app to unicode Pin
PandemoniumPasha8-Jun-07 0:17
PandemoniumPasha8-Jun-07 0:17 
QuestionGEneric List Pin
Tauseef A7-Jun-07 23:55
Tauseef A7-Jun-07 23:55 
AnswerRe: GEneric List Pin
blackjack21508-Jun-07 0:07
blackjack21508-Jun-07 0:07 
AnswerRe: GEneric List Pin
Christian Graus8-Jun-07 0:32
protectorChristian Graus8-Jun-07 0:32 
AnswerRe: GEneric List Pin
leppie8-Jun-07 1:25
leppie8-Jun-07 1:25 
QuestionVSTO Outlook AddIn in C# Pin
NK0077-Jun-07 23:53
NK0077-Jun-07 23:53 
QuestionRead Registry Key Pin
blackjack21507-Jun-07 23:47
blackjack21507-Jun-07 23:47 
AnswerRe: Read Registry Key Pin
PandemoniumPasha7-Jun-07 23:55
PandemoniumPasha7-Jun-07 23:55 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.