Click here to Skip to main content
14,739,371 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
protected void LinkButton_Click(Object sender, EventArgs e)
        {

            String MyConnection2 = "Server=localhost;database=ovs;Uid=root;password=; Convert Zero Datetime=True";
            DateTime time = DateTime.Now;              // Use current time
            string format = "yyyy-MM-dd HH:mm:ss";
            string UserName4 = HttpContext.Current.User.Identity.Name;
            GridViewRow grdrow = (GridViewRow)((LinkButton)sender).NamingContainer;
            Label lblStudentId = (Label)grdrow.Cells[0].FindControl("lblID");
          Label lblvID = (Label)GridView2.Rows[0].FindControl("lblvID");
           string label1val = lblvID.Text;

            string studentId = lblStudentId.Text;
            //    string id =;
            //      string testing = this.Encrypt(id.Trim());
            String query = "insert into voting (CandidateStudentID,voterStudentID,DateTime)values ('" + lblStudentId.Text + "','" + Session["UserName"].ToString() + "','" + time.ToString(format) + "')";
           
            if (Session["UserName"].ToString().Equals(lblvID.Text))
            {

                Label1.Text = "You voted beofre";

            }
            else
            {
                MySqlConnection MyConn2 = new MySqlConnection(MyConnection2);
                MySqlCommand MyCommand2 = new MySqlCommand(query, MyConn2);
                MySqlDataReader MyReader2;
                MyConn2.Open();
                MyReader2 = MyCommand2.ExecuteReader();

                Label2.Text = "Thank you for You Vote";


            }


        }


<pre><asp:GridView ID="GridView2" runat="server"  AutoGenerateColumns="False" Font-Size="Medium">
              <Columns>
              <asp:TemplateField HeaderText="Student ID">
      <ItemTemplate>
         <asp:Label ID="lblvID" runat="server"   Width="150px"  Text='<%#Eval("voterStudentID") %>'/>
     </ItemTemplate>
 </asp:TemplateField>

              </Columns>
           </asp:GridView>


What I have tried:

The link button belongs to gridview 1.I'm getting the index out of range error in the
Label lblvID = (Label)GridView2.Rows[0].FindControl("lblvID");.
Posted
Updated 19-Oct-20 3:53am
v7

1 solution

Quote:
Show the error message and prevent duplicated vote

2 approaches:
- Do a select for the student id, if the result is a record, the student already voted. This can get unlucky if student try to vote simultaneously on 2 computers.
- Design table to have student id unique or primary key, this way, the server will reject insert. To know how the insert did, check its result.

String query = "insert into voting (CandidateStudentID,voterStudentID,DateTime)values ('" + lblStudentId.Text + "','" + Session["UserName"].ToString() + "','" + time.ToString(format) + "')";

Not a solution to your question, but another problem you have.
Never build an SQL query by concatenating strings. Sooner or later, you will do it with user inputs, and this opens door to a vulnerability named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input a name like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability, and the crash is the least of the problems, a malicious user input and it is promoted to SQL commands with all credentials.
SQL injection - Wikipedia[^]
SQL Injection[^]
SQL Injection Attacks by Example[^]
PHP: SQL Injection - Manual[^]
How can I explain SQL injection without technical jargon? - Information Security Stack Exchange[^]

[Update]
Quote:
I can't select the studentID, because the studentID will show the particular student vote for the particular candidate.

Yes you can. You just have to not query all fields of table, just query 1 field, the student id.
   
v2
Comments
ycwong99 19-Oct-20 1:41am
   
I can't select the studentID, because the studentID will show the particular student vote for the particular candidate. I already had a primary key which is the VoteID. This table is linked to another table
ycwong99 19-Oct-20 2:09am
   
I had no idea how to not query all fields, can you give me some example please?
Patrice T 19-Oct-20 2:15am
   
Advice: learn SQL: SQL SELECT Statement[^]
ycwong99 19-Oct-20 3:10am
   
Before the user vote for the candidate, the candidateId in the voting table will be empty, I can't join two tables together because the candidateId in the voting table are empty. Because when I join two tables, I using the candidateID in the voting and candidate table to join
Patrice T 19-Oct-20 8:17am
   
Use Improve question to update your question.
So that everyone can pay attention to this information.
BillWoodruff 19-Oct-20 8:08am
   
+5
Patrice T 19-Oct-20 8:15am
   
Thank you
ycwong99 19-Oct-20 8:53am
   
Hello, I had updated the question

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)




CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900