Click here to Skip to main content
15,920,704 members
Please Sign up or sign in to vote.
1.00/5 (7 votes)
See more:
am not passing data and it should in database

What I have tried:

i have tried passing in queries please give the solution

here i need to enter paas constant string value like string English="English.Text" to the database
SqlCeConnection conn = new SqlCeConnection(DBConnection.GetConnString());

            SqlCeEngine engine = new SqlCeEngine(Common.CommonProperties.ConnString + Common.CommonProperties.Password);
            SqlCeCommand cmd;
            DataSet ds = new DataSet();
            if (textEMail.Text == "" || passwordBox1.Password == "")
            {
                System.Windows.MessageBox.Show(" Enter EmailID and Password .");
                return;
            }

            cmd = new SqlCeCommand("SELECT * FROM Login where EmailID='" + textEMail.Text + "' and Password='" + passwordBox1.Password + "'", conn);
            SqlCeDataAdapter da = new SqlCeDataAdapter(cmd);

            da.Fill(ds);
            int i = ds.Tables[0].Rows.Count;
            if (i == 1)
            {
                conn.Open();
                String q1 = "insert into LoginTime(LoginDate,EmailID,Medium) values(getdate(),'" + textEMail.Text + "','" + Kannada.Text + "')";
                cmd.CommandType = CommandType.Text;

                cmd.CommandText = q1;
                cmd.ExecuteNonQuery();
                System.Windows.MessageBox.Show("You are Successfully Login ");

                Liststd_KM f2 = new Liststd_KM();
                f2.Show();
                this.Hide();
                //ds.Clear();

            }
            else
            {
                System.Windows.MessageBox.Show("Not Registered User or Invalid Name/Password");
                passwordBox1.Password = "";
            }
Posted
Updated 11-Feb-19 2:40am
v2
Comments
OriginalGriff 25-Jan-19 6:58am    
This is not a good question - we cannot work out from that little what you are trying to do.
Remember that we can't see your screen, access your HDD, or read your mind - we only get exactly what you type to work with. And there are so many different things you could be trying! So edit your question, show us the code fragment you are trying to use, and explain what it did that you didn't expect, or didn't do that you did; and tell us how you "know" the data didn't get to the DB.

Use the "Improve question" widget to edit your question and provide better information.
ZurdoDev 25-Jan-19 8:08am    
It's easy to do. Where are you stuck?
RmcbainTheThird 11-Feb-19 7:51am    
By constant string do you mean:
private const string PARENT = "parent";

How to pass constant sting variable into SQL query in C# WPF
1. am not passing data and it should in database
2. What I have tried: i have tried passing in queries please give the solution

Well, not much context to work with; and no code to see where your problems could be.
Guess we'll start with the basics.

How to pass constant sting variable into SQL query in C# WPF
The proper way to do this would be to use a parameterized query for the command you want to execute.
1. Create the command text as a string, and use a a parameter as the placeholder for the variable
string SqlCmdText = "SELECT FNames FROM UserList WHERE EmailAddress = @Email";

Then after your SqlCommand is created, you will add that parameter to the command object
cmd.Parameters.AddWithValue("@Email", UserEmailAddress);

Here is a full sample for you
C#
public static string GetFirstName(string UserEmailAddress) {

  string ReturnValue = "";
  string SqlConnString = "{ Connection String }";
  string SqlCmdText = "SELECT FNames FROM UserList WHERE EmailAddress = @Email";

  using (SqlConnection conn = new SqlConnection(SqlConnString)) {
    using (SqlCommand cmd = new SqlCommand(SqlCmdText, conn)) {
      cmd.CommandType = CommandType.Text;
      cmd.Parameters.AddWithValue("@Email", UserEmailAddress);

      conn.Open();

      var sqlReturn = cmd.ExecuteScalar();
      if (sqlReturn != null) { ReturnValue = sqlReturn.ToString(); }

      conn.Close();
    }
  }
  return ReturnValue;
}


If you have a specific query or code to work with; I would highly suggest that you use the Improve Question widget and add that code in.

Addendum based on now-supplied application code
Thank you for supplying your code.
We have a few issues here:

1. SQL Injection Vulnerability. Never concantenate strings and input values together to make a SQL statement. You become susceptible to whatever an end-user enters into a text box. You can avoid this by using Parameters in the command context.
I have commented out the first instance of the problem and replaced it with how it should be. You will need to do similar to the two other SQL commands that you use
C#
//cmd = new SqlCeCommand("SELECT * FROM Login where EmailID='" + textEMail.Text + "' and Password='" + passwordBox1.Password + "'", conn);
cmd = new SqlCeCommand("SELECT * FROM Login WHERE EmailID= @Email AND Password= @Password", conn);
cmd.Parameters.AddWithValue("@Email", textEMail.Text);
cmd.Parameters.AddWithValue("@Password", passwordBox1.Password);
SqlCeDataAdapter da = new SqlCeDataAdapter(cmd);

2. Plain-Text Passwords
You should never store passwords in plain-text. You should implement some method of hashing to protect them. This will require much more than a quick answer though. I would recommend reading the articles here and elsewhere on the topic. I have worked with implementations of bCrypt and would consider this acceptable as well.
Password Storage: How to do it.[^]
Use BCrypt to Hash Your Passwords: Example for C# and SQL Server « Rob Kraft's Software Development Blog[^]

Combined these are asking to have all credentials stolen
All I would need to do to get all of your login emails and passwords would be to use this email address:
Fred' OR (1=1);--.
This will short circuit your statement to "SELECT * FROM Login", and I now have everyone's plain-text passwords to boot.
 
Share this answer
 
v3
Comments
Maciej Los 6-Feb-19 6:43am    
5ed!
So little code, so many serious errors...
Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
SQL
DROP TABLE MyTable;
A perfectly valid "delete the table" command
SQL
--'
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

Never store passwords in clear text - it is a major security risk. There is some information on how to do it here: Password Storage: How to do it.[^]

SqlConnection, SQLCommand, and so forth are all scarce resources: if you create them,. you should Dispose them. The easiest way to do that is to create them in a using block, and they will automatically be Disposed when they go out of scope.
 
Share this answer
 
C#
cmd = new SqlCeCommand("SELECT * FROM Login where EmailID='" + textEMail.Text + "' and Password='" + passwordBox1.Password + "'", conn);
String q1 = "insert into LoginTime(LoginDate,EmailID,Medium) values(getdate(),'" + textEMail.Text + "','" + Kannada.Text + "')";

Never build an SQL query by concatenating strings. Sooner or later, you will do it with user inputs, and this opens door to a vulnerability named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input a name like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability, and the crash is the least of the problems, a malicious user input and it is promoted to SQL commands with all credentials.
SQL injection - Wikipedia[^]
SQL Injection[^]
SQL Injection Attacks by Example[^]
PHP: SQL Injection - Manual[^]
SQL Injection Prevention Cheat Sheet - OWASP[^]
How can I explain SQL injection without technical jargon? - Information Security Stack Exchange[^]
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900