Click here to Skip to main content
15,914,408 members
Home / Discussions / Database
   

Database

 
GeneralRe: Schedule a program Pin
Pete O'Hanlon25-Apr-08 23:55
mvePete O'Hanlon25-Apr-08 23:55 
GeneralRe: Schedule a program Pin
GuyThiebaut26-Apr-08 3:41
professionalGuyThiebaut26-Apr-08 3:41 
Generaloledb query Pin
Member 412921825-Apr-08 20:07
Member 412921825-Apr-08 20:07 
GeneralRe: oledb query Pin
Blue_Boy26-Apr-08 3:15
Blue_Boy26-Apr-08 3:15 
GeneralRe: oledb query Pin
ChinaTJBoy1-May-08 3:39
ChinaTJBoy1-May-08 3:39 
GeneralRe: oledb query Pin
Member 30299284-May-08 19:55
Member 30299284-May-08 19:55 
GeneralCreate a custom search string Pin
Paul McGann25-Apr-08 7:42
professionalPaul McGann25-Apr-08 7:42 
GeneralRe: Create a custom search string Pin
Mark J. Miller25-Apr-08 9:06
Mark J. Miller25-Apr-08 9:06 
Your approach is valid for the situation, but you are leaving yourself wide open to be hacked. Try this instead:

<br />
Dim search_str As String = "SELECT * FROM Properties WHERE"<br />
Dim parameters As ArrayList = new ArrayList()<br />
<br />
If ddl_type.SelectedValue <> "0" Then<br />
  SqlParameter p = new SqlParameter("@Property_Type", SqlDbType.whatever)<br />
  p.Value = Server.HtmlEncode(ddl_type.SelectedItem.Text)<br />
  search_str += "Property_Type = @Property_Type"<br />
  parameters.Add(p)<br />
End If<br />
<br />
If ddl_location.SelectedValue <> "0" Then<br />
  SqlParameter p = new SqlParameter("@Property_Location", SqlDbType.whatever)<br />
  p.Value = Server.HtmlEncode(ddl_location.SelectedItem.Text)<br />
  search_str += "AND Property_Location = @Property_Location"<br />
End If<br />
<br />
' and so on and so forth....<br />
<br />
SqlCommand cmd = new SqlCommand(search_str)<br />
For i = 0 To parameters.Count - 1<br />
  cmd.Parameters.Add(CType(parameters(i), SqlParameter))<br />
Next<br />
<br />
' execute your query and return the result ....<br />


If you want more information on why do a search for "Sql Injection" and "Cross site scripting" or "XSS". There are also performance reasons for using parameters. Here are some codeproject articles on these topics:

Sql Injection[^]

Cross site scripting (aka XSS)[^]

Ad hoc query performance[^]

Mark's blog: developMENTALmadness.blogspot.com

Funniest variable name:
lLongDong - spotted in legacy code, was used to determine how long a beep should be.
- Dave Bacher

GeneralRe: Create a custom search string Pin
Paul McGann25-Apr-08 9:45
professionalPaul McGann25-Apr-08 9:45 
GeneralRe: Create a custom search string Pin
ChandraRam27-Apr-08 23:24
ChandraRam27-Apr-08 23:24 
Questionis it possible to replicate mysql data on mssql server [modified] Pin
Talsaniya Jayesh25-Apr-08 5:27
professionalTalsaniya Jayesh25-Apr-08 5:27 
QuestionApplication roles Pin
aecordoba25-Apr-08 4:15
aecordoba25-Apr-08 4:15 
Generaltotal Impression for same id and name Pin
r aa j24-Apr-08 23:04
r aa j24-Apr-08 23:04 
GeneralRe: total Impression for same id and name Pin
Blue_Boy25-Apr-08 0:05
Blue_Boy25-Apr-08 0:05 
GeneralRe: total Impression for same id and name Pin
andyharman25-Apr-08 0:12
professionalandyharman25-Apr-08 0:12 
GeneralRe: total Impression for same id and name Pin
Rajkamal_dfine25-Apr-08 20:52
Rajkamal_dfine25-Apr-08 20:52 
Generaldatabase problem Pin
snouto24-Apr-08 22:24
snouto24-Apr-08 22:24 
GeneralRe: database problem Pin
Ashfield24-Apr-08 22:27
Ashfield24-Apr-08 22:27 
GeneralRe: database problem Pin
snouto24-Apr-08 22:29
snouto24-Apr-08 22:29 
GeneralRe: database problem Pin
Vasudevan Deepak Kumar24-Apr-08 22:57
Vasudevan Deepak Kumar24-Apr-08 22:57 
GeneralRe: database problem Pin
Blue_Boy24-Apr-08 22:39
Blue_Boy24-Apr-08 22:39 
GeneralRe: database problem Pin
snouto24-Apr-08 22:42
snouto24-Apr-08 22:42 
GeneralRe: database problem Pin
Blue_Boy24-Apr-08 22:45
Blue_Boy24-Apr-08 22:45 
GeneralRe: database problem Pin
snouto24-Apr-08 22:48
snouto24-Apr-08 22:48 
GeneralRe: database problem Pin
Blue_Boy24-Apr-08 22:50
Blue_Boy24-Apr-08 22:50 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.