checkBox & ListView - C# Discussion Boards

30-Jun-08 0:20

Hi guys! one question if someone can help me. I have a listview and a checkbox. When the app is started the listview is populated from one folder. When the checkbox is checked the listview is automatically populating from different folder. Now, I want when the user will uncheck the checkbox, the listview to be populated again from the first folder. Any help? Thx

Re: checkBox & ListView

Vimalsoft(Pty) Ltd30-Jun-08 1:00

Vimalsoft(Pty) Ltd

30-Jun-08 1:00

hi

Lets see what you have done so far, We cannot help you if we cannot see the code.

Thanks

Re: checkBox & ListView

laziale30-Jun-08 1:19

Determine incorrect String.Format format

30-Jun-08 1:19

I have done this:

    RefreshView();

            FileSystemWatcher fsw = new FileSystemWatcher("C:\\Photos\\Preview");
            fsw.Changed += new FileSystemEventHandler(fsw_Changed);
            fsw.Deleted += new FileSystemEventHandler(fsw_Changed);
            fsw.Created += new FileSystemEventHandler(fsw_Changed);
            fsw.EnableRaisingEvents = true;


the RefreshView method:
            lvFiles.Items.Clear();
            string[] files = Directory.GetFiles("C:\\Photos\\Preview");
            foreach(string file in files)
            {
                lvFiles.Items.Add(file);
            }

so that is trigerred when the user is checking the checkBox. When the checkBox again is unchecked, then nothing is happening. There I want to retrieve again the previous folder, in this case("C:\\Photos")

Thx

Stevo Z29-Jun-08 23:59

Stevo Z

29-Jun-08 23:59

Hi All,

is there way (except running the method in try - catch block) how to determine (without considering the input arguments) if a format string is correct?

String.Format(string format, params object[] argumens);

thanks,

Stevo

zilo

Re: Determine incorrect String.Format format

PIEBALDconsult30-Jun-08 5:10

PIEBALDconsult

30-Jun-08 5:10

You could probably use a RegularExpression.

I'd stick with Try/Catch, as you'd likely need it anyway.

SQL connection execute what?

laziale29-Jun-08 23:13

29-Jun-08 23:13

I want to update a row in my local DB, and what should I use for updating? with executeNonQuery() it doesn't work, or I am doing something else wrong? Here is the code:

string updateQuery = "UPDATE Credentials SET Username = '" + txtUser.Text + "', Password = '" + txtPass.Text + "', Address = '" + txtAddress.Text + "' WHERE Username='" + user + "', Password='" + pass + "', Address='" + address + "'";
           SqlCommand updateCom = con.CreateCommand();
           SqlDataAdapter adapter2 = new SqlDataAdapter();
           updateCom.CommandText = updateQuery;
           adapter2.SelectCommand = updateCom;
           DataSet updateDataSet = new DataSet();
           adapter2.Fill(updateDataSet, dataTableName);
           comm.ExecuteNonQuery();
           con.Close();

thx for the help

Christian Graus29-Jun-08 23:22

29-Jun-08 23:22

Well, you know that this code is very insecure and easy to hack, right ?

What is con ? This does look messy to me. You don't need half of these objects, I am sure of that.

Here is an example I found with google:

Public Sub CreateMySqlCommand(myExecuteQuery As String, myConnection As SqlConnection)
Dim myCommand As New SqlCommand(myExecuteQuery, myConnection)
myCommand.Connection.Open()
myCommand.ExecuteNonQuery()
myConnection.Close()
End Sub 'CreateMySqlCommand

IT's VB.NET, but it's clear which objects you should use, how you should use them, and where you're getting confused.

Christian Graus

Please read this if you don't understand the answer I've given you. If you're still stuck, ask me for more information.

laziale29-Jun-08 23:28

29-Jun-08 23:28

con is the sql connection what I am declaring above the query. It doesn't work on the way you told me, but thx for the help anyway

Christian Graus29-Jun-08 23:36

29-Jun-08 23:36

As colin said, you are wide open for attacks. The code I posted, is all you need. If your SQL itself is broken, I don't know, I didn't look that deep, the code was too stuffed for me to worry.

Run your code in the debugger, get out the SQL string, run it inside the DB directly, and work out if you have errors in your SQL. Then fix your SQL access code. Then read up on SQL injection and make your code safe. Right now, it's a mess on all fronts.

Christian Graus

Please read this if you don't understand the answer I've given you. If you're still stuck, ask me for more information.

Mbah Dhaim29-Jun-08 23:27

Mbah Dhaim

29-Jun-08 23:27

string updateQuery = "UPDATE Credentials SET Username = '" + txtUser.Text + "', Password = '" + txtPass.Text + "', Address = '" + txtAddress.Text + "' WHERE Username='" + user + "', Password='" + pass + "', Address='" + address + "'";

---> i think this is the first error, change to this :

string updateQuery = "UPDATE Credentials SET Username = '" + txtUser.Text + "', Password = '" + txtPass.Text + "', Address = '" + txtAddress.Text + "' WHERE Username='" + user + "' AND Password='" + pass + "' AND Address='" + address + "'";

SqlCommand updateCom = con.CreateCommand();//OK
SqlDataAdapter adapter2 = new SqlDataAdapter();// ** i don't know why u using this adapter? for what purpose
updateCom.CommandText = updateQuery;//OK
adapter2.SelectCommand = updateCom;//see previous **
DataSet updateDataSet = new DataSet();//see previous **
adapter2.Fill(updateDataSet, dataTableName);//see previous **
// add this
con.Open();
comm.ExecuteNonQuery();
con.Close();

dhaim
program is hobby that make some money as side effect Smile | :)

Colin Angus Mackay29-Jun-08 23:31

Colin Angus Mackay

29-Jun-08 23:31

dhaim wrote:
change to this

NO! That is still vulnerable to SQL Injection Attacks.

Recent blog posts:
* Event Organisation (Feedback)
* LINQ to XML (part 4)
* Scottish Developers June Newsletter

My Blog

Mbah Dhaim29-Jun-08 23:37

Mbah Dhaim

29-Jun-08 23:37

i know, even in my code i will not do that, just reply submitted code Cool | :cool:

dhaim
program is hobby that make some money as side effect Smile | :)

laziale29-Jun-08 23:34

29-Jun-08 23:34

the same query, like I wroted here, I am using with MSSMS, and it works fine and is updating the table, and when I am using here with C#, it doesn't. I get rid of the DataAdapters, I put them because I thought is similar like for SELECT query, now I remove them. The connection is open before the query, I am having one more query for selecting the data, and after that I am trying to update the data. According to your last post, now my code looks like this:

//the connection is already open
con.Open();

string updateQuery = "UPDATE Credentials SET Username = '" + txtUser.Text + "', Password = '" + txtPass.Text + "', Address = '" + txtAddress.Text + "' WHERE Username='" + user + "',AND Password='" + pass + "', AND Address='" + address + "'";
SqlCommand updateCom = con.CreateCommand();
updateCom.CommandText = updateQuery;
comm.ExecuteNonQuery();
con.Close();

thx guys...

Christian Graus29-Jun-08 23:39

29-Jun-08 23:39

Well, the SQL looks like it should run. So, one has to ask, how do you know it's not working ? Are you sure a record with those three values exists ? Why are you using three values instead of a primary key ?

Christian Graus

Please read this if you don't understand the answer I've given you. If you're still stuck, ask me for more information.

Colin Angus Mackay29-Jun-08 23:30

Colin Angus Mackay

29-Jun-08 23:30

First off the biggest WTF with this is that it is susceptable to a SQL Injection Attack. Please learn about these and protect your self (they are created by poor programming practices). Here is an article that should help you avoid SQL Injection Attacks in the future: http://www.codeproject.com/KB/database/SqlInjectionAttacks.aspx[^]

Secondly, there is zero need for a SqlAdapter in this case. You need a SqlConnection and a SqlCommand - that is all.

Recent blog posts:
* Event Organisation (Feedback)
* LINQ to XML (part 4)
* Scottish Developers June Newsletter

My Blog

laziale29-Jun-08 23:36

29-Jun-08 23:36

I don't care about the injection right now...I just want to update the record, to see how is working...after that I can try to update with stored procedure, if you guys know how I can update with stored procedure I will be very grateful.

Christian Graus29-Jun-08 23:38

29-Jun-08 23:38

You don't NEED a stored proc, and if you can't work out how to run SQL, I don't see how you can work out how to run the proc, which involves more code. You need to get rid of all the crap in your function, as I already said, and as Colin said. Perhaps you need to start with SQL like 'insert into mytable values(1,2,3)' or whatever, SQL that is simple and you know works. Then use this to fix your SQL access code. Then work out the problems in your SQL.

If you prefer to run a proc, that's fine, and almost as easy, the examples are just as easy to google, too. A stored proc will give you a degree of injection protection, too.

Christian Graus

Please read this if you don't understand the answer I've given you. If you're still stuck, ask me for more information.

laziale29-Jun-08 23:40