Click here to Skip to main content
15,889,281 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
Hi,
I have an issue that sometimes my data inserting two times in database with difference just mini second like
2020-02-18 17:05:15.533 &  2020-02-18 17:05:40.440 
with same client data but my auto-generated no. is different

can you please explain why this happens

My Database is SQL SERVER 2012 EXPRESS ADDITION & FRONT END IS VISUAL STUDIO 2010

The above issue getting some time & my database is in-network pc.

What I have tried:

My Code is

sqlselect.CommandText = "insert into tableName(Auto_No,Auto_Type,Auto_Date,Log_By) values('" & strNo & "','NEW',SYSDATETIME(),1)"
                  sqlselect.ExecuteNonQuery()


I M USING WITH TRANSACTION.
Posted
Updated 19-Feb-20 20:00pm
v3

1 solution

Before you try to fix that, you need to change your whole app: Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
SQL
DROP TABLE MyTable;
A perfectly valid "delete the table" command
SQL
--'
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

When you've done that, start looking at you current problem, if it still exists.
But we can't help you with that: the two time differences you show are 25 seconds apart, so it's likely that your code is executing twice at different times - you will have to use the debugger to find out exactly what is happening, and then start thinking about why - and we can't do that for you!
But ... if you are expecting the "Auto_no" to be different each time, then you are definitely doing it wrong - you should not be trying to set it to a value from your presentation software, you should be letting the DB handle that - particularly with a server based system which is inherently multiuser. Generating it outside the DB is a good way to get some really, really nasty intermittent bugs which can meww your whole DB up beyond hope of repair. Consider using an IDENTITY field instead.
 
Share this answer
 
Comments
hareshdgr8 20-Feb-20 2:31am    
sir for your above query i am using like this SELECT * FROM MyTable WHERE StreetAddress = 'Baker''s Wood'. I m using double single quote insted of single it will auto replace my application so wont get any issue if some one pass this type of issue sir any other hint or help can you please provide me its greate help to me ...

Whenever you help me every time it works sir ... please help me more about this issue.

Waiting sir..
OriginalGriff 20-Feb-20 3:16am    
Use parameterised queries: it's easier, safer, and much simpler than faffing about trying to sanitise your inputs and desanitise them when you read them back ...

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900