Click here to Skip to main content
15,920,602 members
Home / Discussions / C#
   

C#

 
GeneralRe: mouse position from Non client area Pin
Stefan Troschuetz23-Sep-04 1:44
Stefan Troschuetz23-Sep-04 1:44 
GeneralRe: mouse position from Non client area Pin
Ajmoda23-Sep-04 1:51
Ajmoda23-Sep-04 1:51 
GeneralRe: mouse position from Non client area Pin
Stefan Troschuetz23-Sep-04 1:57
Stefan Troschuetz23-Sep-04 1:57 
GeneralRe: mouse position from Non client area Pin
Ajmoda23-Sep-04 2:03
Ajmoda23-Sep-04 2:03 
Questionwhat is this error Pin
ydderf223-Sep-04 0:18
ydderf223-Sep-04 0:18 
AnswerRe: what is this error Pin
exhaulted23-Sep-04 0:30
exhaulted23-Sep-04 0:30 
AnswerRe: what is this error Pin
sreejith ss nair23-Sep-04 0:43
sreejith ss nair23-Sep-04 0:43 
GeneralRe: what is this error Pin
Heath Stewart23-Sep-04 5:58
protectorHeath Stewart23-Sep-04 5:58 
No, neither is good. You use parameterized commands using the OracleParameter. Haven't I told you this before, sreejith? Please don't give bad advice.

Using parameterized commands helps avoid SQL injection attacks. If I knew that sreejith designed a Windows or web application using this (which is easy to find out because I can easily disassemble his assembly), I could do just about anything given enough permissions by setting co_emid.Text (through the interface) to the follow:
blah'; drop table Products --
No more products table. I could certainly do a lot worse.

Plus, sreejith, more than likely - judging from "emp_id" - co_emid.Text represents a number. In that case, you need to use int.Parse or Convert.ToInt32(string) or something similar.

But, as far as parameterized queries go, your code should look like so:
OracleCommand cmd = new OracleCommand(conn,
  "insert Products values (:emp_id)");
try
{
  cmd.Parameters.Add("emp_id", OracleType.Number, 8).Value =
    int.Parse(co_emid.Text); // could throw an exception for improper format
  conn.Open();
  cmd.ExecuteNonQuery();
}
catch (FormatException)
{
  MessageBox.Show("Invalid employee id.");
  co_emid.Focus();
}
finally
{
  conn.Close();
}


This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles]
GeneralRe: what is this error Pin
sreejith ss nair23-Sep-04 17:51
sreejith ss nair23-Sep-04 17:51 
AnswerRe: what is this error Pin
Dave Kreskowiak23-Sep-04 0:43
mveDave Kreskowiak23-Sep-04 0:43 
AnswerRe: what is this error Pin
Michael P Butler23-Sep-04 0:57
Michael P Butler23-Sep-04 0:57 
GeneralRuntime.getRuntime().addShutdownHook(new Hook()) Pin
devvvy22-Sep-04 23:45
devvvy22-Sep-04 23:45 
GeneralRe: Runtime.getRuntime().addShutdownHook(new Hook()) Pin
exhaulted23-Sep-04 0:27
exhaulted23-Sep-04 0:27 
GeneralRe: Runtime.getRuntime().addShutdownHook(new Hook()) Pin
devvvy23-Sep-04 3:48
devvvy23-Sep-04 3:48 
GeneralRe: Runtime.getRuntime().addShutdownHook(new Hook()) Pin
LongRange.Shooter23-Sep-04 8:24
LongRange.Shooter23-Sep-04 8:24 
GeneralRe: Runtime.getRuntime().addShutdownHook(new Hook()) Pin
devvvy24-Sep-04 5:59
devvvy24-Sep-04 5:59 
Generaltextbox in a webpage problem Pin
Sakkijha22-Sep-04 23:28
Sakkijha22-Sep-04 23:28 
GeneralRe: textbox in a webpage problem Pin
Dave Kreskowiak23-Sep-04 0:32
mveDave Kreskowiak23-Sep-04 0:32 
GeneralRe: textbox in a webpage problem Pin
sreejith ss nair23-Sep-04 0:38
sreejith ss nair23-Sep-04 0:38 
GeneralRe: textbox in a webpage problem Pin
shambho23-Sep-04 4:21
shambho23-Sep-04 4:21 
GeneralMinimizing a form Pin
exhaulted22-Sep-04 23:25
exhaulted22-Sep-04 23:25 
GeneralRe: Minimizing a form Pin
sreejith ss nair23-Sep-04 1:15
sreejith ss nair23-Sep-04 1:15 
GeneralRe: Minimizing a form Pin
eggie523-Sep-04 2:16
eggie523-Sep-04 2:16 
GeneralPlease Help Pin
exhaulted22-Sep-04 23:13
exhaulted22-Sep-04 23:13 
GeneralRe: Please Help Pin
sreejith ss nair23-Sep-04 1:35
sreejith ss nair23-Sep-04 1:35 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.