Click here to Skip to main content
15,615,922 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hi all,

I have created a DataAccesslayer as, DCoonection.cs.
Here I have defined a method for connection DBAccess.cs methods for insertion, deletion, updation etc.

Suppose I have to write an insertion query for a table where I will have to pass from business logic or do I have to create another class for entry?
Updated 3-Nov-10 22:47pm
Dalek Dave 4-Nov-10 4:50am    
Edited for Grammar and Syntax.

1 solution

In an ideal situation, you would use a stored procedure to parametrize the process so that you protect yourself from injection attacks. Your DBAccess class should have a method that executes the call to that procedure and your business class object should call the DBAccess class to get the data inserted.

BUSINESS calls DBAccess calls StoredProc inserts Data

If you absolutely have to write sql. You should do that in the DBAccess object, but by all means scrub the data values before creating the sql to send to the db.
Share this answer

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900