|
Hello
I want to be able to get one record from the teacher's table and still the record in the Database. The user will enter the ID number and then press a find button. The contents of this record can be
displayed in some text boxes.
Code:
cnnTeacher.ConnectionString = @"Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:\IBS Library System\LibrarySystem.mdb;Persist Security Info=False";
OleDbDataAdapter daTeacher = new OleDbDataAdapter("SELECT * FROM Teacher WHERE teacherID = '" + txtIDNumber.Text + "' ",cnnTeacher);
OleDbCommandBuilder cbTeacher = new OleDbCommandBuilder(daTeacher);
daTeacher.Fill(dtTeacher);
txtName.text = //code to go here for display the name of the teacher from finding ID number
Many thanks in advance
|
|
|
|
|
NEVER use concatenation for SQL commands. What do you think happens when I enter the following in your txtIDNumber TextBox?
0' and 1 = 1; drop table Teacher-- I'll tell you what happens - you get 0wned. Your Teacher table is dropped. I could do a lot worse, too. And don't think I can't figure out what you're doing. Many people will look for simple holes like this, and with .NET and Java (or any JIT compiled language or scripting language, for that matter) it's easy because I can easily disassemble or even decompile your application. With web applications some crackers will try typical SQL inject attacks like this. If a simple crack works, believe me they'll be dropping tables, stealing credit card numbers, falsifying product orders...just about anything.
Use parameterized queries like so:
cnnTeacher.ConnectionString = @"...";
OleDbCommand cmd = cnnTeacher.CreateCommand();
cmd.CommandText = "select * from Teacher where teacherID = ?";
cmd.Parameters.Add("ID", OleDb.VarWChar, 40).Value = txtIDNumber.Text;
OleDbDataAdapter daTeacher = new OleDbDataAdapter(cmd);
daTeacher.Fill(dtTeacher);This prevents SQL injection attacks because there's a lot of checks implemented in the .NET Framework.
How do you bind data to controls? Certain not how you're doing it again. That is just assigning values, not actually binding data. To learn about data-binding, read Data Binding with Windows Forms and ADO.NET (.NET Development (General) Technical Articles)[^], any one of the samples in .NET Samples - Windows Forms: Data Binding[^], or search this site for a slew of articles on data-binding.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles]
|
|
|
|
|
|
<blink> is a remnant of Netscape and only supported by Mozilla because Netscape pays the bills. It never was a standard and according to W3C sources I've read about, it never will be.
Just view your comment in IE and see for yourself.
Besides, it's greatly overused. I once saw a professor that blinked an entire paragraph - and a long one at that - to draw attention to it (it was already red and bold). It took quite a while to actually read what it said. 
And don't fret - I'm just ranting. I've hated blink ever since it was conceived and that sentiment hasn't changed since then. 
BTW, I made it bold and basically flamed him because I get so tired of repeating the same ol', same ol'...about not using concatenation for SQL commands, that an unmanaged long isn't the same as a managed long, and quite a bit else. If only people searched the forum before posting, but if they could do that they probably wouldn't have quite so many problems.
|
|
|
|
|
AN UNMANAGED LONG IS A MANAGAGED INT!
/\ |_ E X E GG
|
|
|
|
|
Good - someone remembers what I say 50 times a day, it seems. Of course you visit here often. I know many don't and maybe post a couple messages to CodeProject and never return (I feel so used  ). I'm thinking about writing an article with all the stuff I always say and just start directing people toward it each time I have to say it once again.
What do you think? I know Nick Parker told me I should long ago (and we're actually friends in the real workd), so I think I may.
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles]
|
|
|
|
|
Yeah, I remember you mentioned that Nick and you were working on one a while ago... I was pretty intersted in it. I imagine it would be quite large though.... Are you thinking of sorta a "FAQ Article"?
/\ |_ E X E GG
|
|
|
|
|
Yeah.. I know. I personally hate animated/moving stuff on pages.... But NEVER would have been a good candidate for a blink there
The problem I see with people using concatenation for SQL is that most books on SQL don't deal with issues like SQL Injection. I haven't looked at many (we have 2 or 3 T-SQL and PL/SQL references books on shelves in work) but those that I did rarely if ever mentioned the danger of SQL Injection... It's as though they see it as somthing that needs to be addressed by programming books and data access references only. It drives me insane to thnk that students throughout universities and colleges around the world are not being instructed on the simple dangers.
Regards,
Brian Dela
http://www.briandela.com IE 6 required.
http://www.briandela.com/pictures Now with a pictures section 
http://www.briandela.com/rss/newsrss.xml RSS Feed
|
|
|
|
|
Brian Delahunty wrote:
It drives me insane to thnk that students throughout universities and colleges around the world are not being instructed on the simple dangers.
What should really drive you insane - and the reason, most often, for students not being taught what they should - is that the professors don't know! Granted, there's exceptions, especially at places like MIT, Berkely, CMU, and others, but many professors themselves don't know.
Besides, I'm a big fan of self-discovery and research. I learned far more before and during - but not in - college than I ever did at college. It takes a real interest in computer science and engineering (depending on whether your into the softer- or harder-side of computers...maybe even both) to be good and that, I believe, is what separates the good from the, well, bad.
|
|
|
|
|
I have a couple of questions regarding a System.Windows.Forms.UserControl derived control that is to be hosted in IE. Basic functionality seems to work, but I'm unable to figure out how to EnableVisualStyles...since IE is the parent application. All buttons on the control appear flat and square. Attempting to invoke the Application.EnableVisualStyles() call within my control's Load event causes IE to GPF. Attempting to host a Form within my control that contains a button with the flat style set to System still results in flat buttons.
Also, I'm not able to get keyboard hot keys to work for any buttons on the user control. The tab key works for moving focus between buttons, and the mouse key works, but if I hit alt-char to invoke the hot key...nothing.
Am I limited to creating owner draw buttons and handling keyboard events at the control level? Anyone have any experience in this area?
Thank you in advance.
Ron Ward
|
|
|
|
|
I've done quite a bit of work in this area dating way back to the .NET 1.0 beta days.
As far as hot keys, understand that only dialogs process characters and may or may not pass those messages to child controls, such as your UserControl. In the case of IE, it most likely won't because a site could hijack your settings (the web is a very dangerous place to visit, probably even more hostile than Iraq right now!). That would be my educated guess.
As far as visual styles, calling Application.EnableVisualStyles() must be done in an application - not your control. What this does is load a general manifest from the .NET Framework directory (ex: %WINDIR%\Microsoft.NET\Framework\v1.1.4322) BEFORE controls are created, which encapsulate the Windows Common Controls. Once those are loaded into an address space for a process and used by a particular module, that module cannot use two different versions (but the process can, IIRC).
You need to instead embed a manifest in your PE/COFF executable (not the assembly itself, rather, the manifest of resources) using a particular ID.
For starters, read my article Windows XP Visual Styles for Windows Forms[^], which describes the "old" way (still supported) of embedding manifests as Win32 resources. You'll also want to read Visual Styles[^] on MSDN.
Another article you may find interesting about making your embedded UserControl scriptable (as well as exposing events), take a look at a very old article of mine on a different site, User Controls for Winodws and the Web[^].
This posting is provided "AS IS" with no warranties, and confers no rights.
Software Design Engineer
Developer Division Sustained Engineering
Microsoft
[My Articles]
|
|
|
|
|
Hello,
I Hope someone can help me with my problem.
I Do the following:
- Create application
- Put combobox on main-form
- Add values in combo-box collections
When I run the application the items in de combobox are not visible. When I click on an invisible item, the value appears in the combobox, so the items are present.
When I copy the application to any other pc and run it, it all works fine, there is no problem.
When I build the application on the other pc and run it on mine, it all works fine too.
My colors are correct (background and textcolor are definitly not the same color).
Help!!!
|
|
|
|
|
hi,
Check the forcolor of your combobox and make sure that the color is not Transparent.
**************************
S r e e j i t h N a i r
**************************
|
|
|
|
|
Thanks for your answer.
I checked de forecolor. Its value is WindowText (In my case black)
|
|
|
|
|
hi,
Did you installed any theams on your machine.
**************************
S r e e j i t h N a i r
**************************
|
|
|
|
|
|
hi,
I am really sorry.
**************************
S r e e j i t h N a i r
**************************
|
|
|
|
|
I had the same problem and was caused by McAfee VirusScan Enterprise 8.0i's Buffer overflow protection.
I tried to disable it and my comboboxes start working well again.
If someone has the same problem read the document in
this location
|
|
|
|
|
simply, i want to make a c# program that counts words in a sentence entered by the user. i know a method to count no. of characters in a certain sentence, but what about words, what's the idea ?! i'd appreciate it if anyone could help here.
|
|
|
|
|
<br />
string[] words = sentence.Split(' ');<br />
int count = words.Length;<br />
?
|
|
|
|
|
thnx a lot man. but am sorry i got another question, this two lines of code counts the number of words only in case they got only one space character between each two words, what about if i got a sentence like this
"hello world" with 5 space characters for example and not "hello world" with one space character.
the program won't count the first sentence as two words i think.
|
|
|
|
|
Check for the length of each instance in the array If it has 1 character or more it is a word.
Try something like the following
string[] words = sentence.Split(' ');<br />
count = 0;<br />
<br />
for (int x = 0; x < words.Length; x++)<br />
{<br />
if (words[x].Length > 0)<br />
count++;<br />
}
Kev
|
|
|
|
|
|
int count = Regex.Replace("Hello World", @"\s+", " ").Trim(' ').Split(' ').Length;
That should work fine.. You can also have spaces at the front and the end of the string and it will still work.
e.g.
string testString = " This is my Dog ";
int count = Regex.Replace(testString, @"\s+", " ").Trim(' ').Split(' ').Length;
Regards,
Brian Dela 
http://www.briandela.com IE 6 required.
http://www.briandela.com/pictures Now with a pictures section 
http://www.briandela.com/rss/newsrss.xml RSS Feed
|
|
|
|
|
Well, i made a Minesweeper.
The Cells, are a class inherit from Label.
To display the images, i set the BackgroundImage.
But on the Expert mode ( 50x50 ) the game is extremely heavy and laggy 
What can i do? Draw with DX? oO
Using components, doesnt work, its very heavy :\
Thanks.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
