|
people still use this?
Caveat Emptor.
"Progress doesn't come from early risers – progress is made by lazy men looking for easier ways to do things." Lazarus Long
|
|
|
|
|
VB or Access? 
"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
Yep, VB was complete and utter filth back in its day. That people still use it is somewhat astonishing.
Whenever you find yourself on the side of the majority, it is time to pause and reflect. - Mark Twain
|
|
|
|
|
I'm currently doing a VB project 
I don't have a lot of problems with VB, although I find C# a lot more elegant.
In theory VB and C# had pretty much the same capabilities and you could write clean code in both.
In practice, VB programmers are far more often a bunch of amateurish bunglers who couldn't write clean code if their life depended on it
That doesn't mean those people don't write C# code either!
|
|
|
|
|
There is a problem in almost every line of that code.
|
|
|
|
|
You're being a little harsh, there!
I thought it was rather innovative in the way that it uses the same TextBox for both user name and password.
Whenever you find yourself on the side of the majority, it is time to pause and reflect. - Mark Twain
|
|
|
|
|
Well ... makes it easier to remember!
"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
AntiTwitter: @DalekDave is now a follower!
|
|
|
|
|
It also makes it easier to debug. The problem is definitely associated with that text box.
".45 ACP - because shooting twice is just silly" - JSOP, 2010
-----
You can never have too much ammo - unless you're swimming, or on fire. - JSOP, 2010
-----
When you pry the gun from my cold dead hands, be careful - the barrel will be very hot. - JSOP, 2013
|
|
|
|
|
|
You call it password, I call it address, let's call the whole thing off!
|
|
|
|
|
Not to mention storing the password in plain text.
But on the plus side, it doesn't have a SQL Injection vulnerability. Which is quite rare for this sort of question. 
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
Richard Deeming wrote: But on the plus side, it doesn't have a SQL Injection vulnerability. Which is quite rare for this sort of question.
Good point.
All those who say "there's nothing new under the sun", take note!
Whenever you find yourself on the side of the majority, it is time to pause and reflect. - Mark Twain
|
|
|
|
|
admin, admin?
Social Media - A platform that makes it easier for the crazies to find each other.
Everyone is born right handed. Only the strongest overcome it.
Fight for left-handed rights and hand equality.
|
|
|
|
|
|
This is a rare example of a question which isn't vulnerable to SQL Injection. Bobby Tables doesn't apply here.
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
You are of course entirely right. I'd read the code and my brain screamed "this is so wrong" so loudly that I overlooked the parameters... 
|
|
|
|
|
Never use SQL in your production code. Always use stored procedures and pass in parameters where necessary. This is one of the ways hackers use to SQL inject your code.
"There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult." - C.A.R. Hoare
Home | LinkedIn | Google+ | Twitter
|
|
|
|
|
You can use parameters without stored procedures.
|
|
|
|
|
That wasn't the point I was making. It was about avoiding SQL injection and using stored procedures instead of passing SQL over the wire in your code.
"There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult." - C.A.R. Hoare
Home | LinkedIn | Google+ | Twitter
|
|
|
|
|
Dominic Burford wrote: That wasn't the point I was making.
Well, certainly seemed like that.
Dominic Burford wrote: It was about avoiding SQL injection
That's unrelated to Stored Procedures.
Dominic Burford wrote: and using stored procedures instead of passing SQL over the wire in your code.
Well, if your application server isn't on the same network as the database, you're having much bigger problems.
|
|
|
|
|
Like many developers, we use third-party providers for our hosting requirements. This includes our application and database. They are hosted independently on separate Azure instances (and in separate geographic regions). Having the two hosted on separate servers is neither unusual nor a problem.
Using a stored procedure to initiate a CRUD operation allows you to reduce the likelihood of a SQL injection attack as you are not passing raw SQL statements over the wire from the application to the database.
Don't just take my word for it, this is the advice given by many articles for reducing the problem.
"There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult." - C.A.R. Hoare
Home | LinkedIn | Google+ | Twitter
|
|
|
|
|
People who say "never" and "always" tend to be wrong a lot.
|
|
|
|
|
Not in this case.
"There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult." - C.A.R. Hoare
Home | LinkedIn | Google+ | Twitter
|
|
|
|
|
Member 14629409 wrote: visual basic 2008...
Mind Bleach! Send me Mind Bleach!!!! 
Will Rogers never met me.
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
