Click here to Skip to main content
15,915,832 members
Home / Discussions / C#
   

C#

 
GeneralRe: trap state changes (standbye, hibernate, etc) Pin
Heath Stewart20-Jul-04 3:40
protectorHeath Stewart20-Jul-04 3:40 
GeneralCultureInfo for unsupported Culture Pin
Colin Angus Mackay19-Jul-04 11:25
Colin Angus Mackay19-Jul-04 11:25 
GeneralRe: CultureInfo for unsupported Culture Pin
Heath Stewart19-Jul-04 11:40
protectorHeath Stewart19-Jul-04 11:40 
GeneralRe: CultureInfo for unsupported Culture Pin
Colin Angus Mackay20-Jul-04 2:39
Colin Angus Mackay20-Jul-04 2:39 
GeneralRe: CultureInfo for unsupported Culture Pin
Heath Stewart20-Jul-04 3:56
protectorHeath Stewart20-Jul-04 3:56 
GeneralRe: CultureInfo for unsupported Culture Pin
Colin Angus Mackay20-Jul-04 10:45
Colin Angus Mackay20-Jul-04 10:45 
GeneralVery simple search on a form Pin
janigorse19-Jul-04 10:59
janigorse19-Jul-04 10:59 
GeneralRe: Very simple search on a form Pin
Heath Stewart19-Jul-04 11:23
protectorHeath Stewart19-Jul-04 11:23 
There are several problems here. With every character you type, TextChanged is fired. Since your updating your DataSet in the background using the same SqlConnection, then all those threads are trying to open separate connections to the same resource (the SqlConnection instance) at once. Even using separate connection resources isn't a good way, because this code is grossly inefficient (with each character typed, the database is queried). Instead, either use a button that filters the results when clicked, or use the LostFocus event or something for a TextBox.

Also, you're relying on input from the user to fill the WHERE clause. This is extremely bad. Think of what would happen if I typed the following into a TextBox:
A';DELETE FROM Avtosalon WHERE Ime LIKE '
That would delete all records in your Actosalon table - and even worse is possible if your DB security isn't tight (I could drop the master table, for example). The important thing when writing software is NEVER TRUST USER INPUT - no matter who the user is (they could inadvertently do something bad). And don't think they won't know your database structure: I could use the IL Disassembler (ildasm.exe) that comes with the SDK (free) or some other disassembler/decompiler and easily find out how to attack your code and database.

Instead, do what you're supposed to use with ADO.NET: parameterized queries. Read about the SqlParameter class and the SqlCommand.Parameters property in the .NET Framework SDK for lots of information and example source code. Using this not only makes for easier to read code, but eliminates the need for you to make sure strings are escaped (which is one thing that allows me to type what I did above) and it automatically performs checks for common attacks, this decreasing the attack surface.

 

Microsoft MVP, Visual C#
My Articles
Generalintegrate context menu with shell Pin
goooooooogle19-Jul-04 9:52
goooooooogle19-Jul-04 9:52 
GeneralRe: integrate context menu with shell Pin
Nick Parker19-Jul-04 10:40
protectorNick Parker19-Jul-04 10:40 
GeneralRe: integrate context menu with shell Pin
Dave Kreskowiak19-Jul-04 15:24
mveDave Kreskowiak19-Jul-04 15:24 
GeneralRichTextBox Question Pin
bneacetp19-Jul-04 9:44
bneacetp19-Jul-04 9:44 
GeneralRe: RichTextBox Question Pin
leppie19-Jul-04 11:12
leppie19-Jul-04 11:12 
GeneralRe: RichTextBox Question Pin
Heath Stewart19-Jul-04 11:31
protectorHeath Stewart19-Jul-04 11:31 
GeneralRe: RichTextBox Question Pin
bneacetp19-Jul-04 11:40
bneacetp19-Jul-04 11:40 
GeneralPrint button with SSRS Pin
clydeJones19-Jul-04 8:51
clydeJones19-Jul-04 8:51 
GeneralDynamic Help Using HtmlHelp API and COM Interfaces Pin
JimmyG1319-Jul-04 7:57
JimmyG1319-Jul-04 7:57 
GeneralKeyDown event is not firing while draging node on treeview Pin
god4k19-Jul-04 6:51
god4k19-Jul-04 6:51 
GeneralRe: KeyDown event is not firing while draging node on treeview Pin
leppie19-Jul-04 6:59
leppie19-Jul-04 6:59 
GeneralRe: KeyDown event is not firing while draging node on treeview Pin
Heath Stewart19-Jul-04 9:10
protectorHeath Stewart19-Jul-04 9:10 
GeneralReturning a filtered DataTable Pin
Andy H19-Jul-04 6:44
Andy H19-Jul-04 6:44 
GeneralRe: Returning a filtered DataTable Pin
Werdna19-Jul-04 8:58
Werdna19-Jul-04 8:58 
GeneralRe: Returning a filtered DataTable Pin
Heath Stewart19-Jul-04 9:04
protectorHeath Stewart19-Jul-04 9:04 
GeneralRe: Returning a filtered DataTable Pin
Andy H19-Jul-04 22:40
Andy H19-Jul-04 22:40 
Generalfunction usage in a .config file Pin
Ryan@Salamandertechnologies.com19-Jul-04 6:39
sussRyan@Salamandertechnologies.com19-Jul-04 6:39 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.