Click here to Skip to main content
15,890,882 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hello Dear programer(s)
i developing the c# attendance application and this application data saved in the php-mysql.
i have one table attendance which saves data about new student and one table for save attendance named "absent_student" and its field is semester,course,division,date,rollno,name and status.i first selecting all data according to course semester and division field(column)using combobox from attendance table and inserting in absent_student table but date and status adding after the new column using following code after clicking on button.
The date is properly adding but status add using value of checkedlistbox
this not properly added.
(code)
C#
private void button2_Click(object sender, EventArgs e)
        {
            try
            {
                con = new MySqlConnection(constring);
                cmdabsent = new MySqlCommand("SELECT sem,course,division,rollno,name FROM attendance WHERE course='" + coursecombo + "' AND sem='" + semcombo + "' AND division='" + divcombo + "'", con);
                MySqlDataAdapter dafillabsent = new MySqlDataAdapter(cmdabsent);
                MySqlCommandBuilder cmdbul = new MySqlCommandBuilder(dafillabsent);
                DataSet dsfillabsent = new DataSet();
                dsfillabsent.Clear();
                dafillabsent.Fill(dsfillabsent, "AllAbsent");
                dsfillabsent.Tables["AllAbsent"].Columns.Add(new DataColumn("date"));
                dsfillabsent.Tables["AllAbsent"].Columns.Add(new DataColumn("status"));
                CheckedListBox.CheckedItemCollection o = checkedListBox1.CheckedItems;
                for(int i=0;i<=Convert.ToInt32(total)-1;i++)
                {
                    dsfillabsent.Tables["AllAbsent"].Rows[i]["date"] = Convert.ToDateTime(dateTimePicker1.Value);
                    if (o.Contains(i))
                    {
                        dsfillabsent.Tables["AllAbsent"].Rows[i]["status"] = "A";
                    }
                    else
                    {
                        dsfillabsent.Tables["AllAbsent"].Rows[i]["status"] = "P";
                    }
                }

                    //dafillabsent.Update(dsfillabsent.Tables["AllAbsent"]);


                    dataGridView1.DataSource = dsfillabsent.Tables["AllAbsent"];
            }
            catch (Exception ex)
            {
                MessageBox.Show("ERROR: " + ex, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
            }
        }

please suggest me.
wait for answer
Thank you.
Posted
Updated 12-Dec-14 5:34am
v2
Comments
Richard Deeming 12-Dec-14 11:57am    
Your code is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

1 solution

I think you need CheckedIndices
C#
if (checkedListBox1.CheckedIndices.Contains(i))
                    {
                        dsfillabsent.Tables["AllAbsent"].Rows[i]["status"] = "A";
                    }
                    else
                    {
                        dsfillabsent.Tables["AllAbsent"].Rows[i]["status"] = "P";
                    }
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900