Click here to Skip to main content
15,887,464 members
Home / Discussions / Visual Basic
   

Visual Basic

 
AnswerRe: Newbie Question: Loading Forms Pin
Chatura Dilan31-Mar-06 15:59
Chatura Dilan31-Mar-06 15:59 
QuestionEvents Button Pin
MarkMokris31-Mar-06 10:28
MarkMokris31-Mar-06 10:28 
AnswerRe: Events Button Pin
Dave Kreskowiak31-Mar-06 13:19
mveDave Kreskowiak31-Mar-06 13:19 
QuestionResize jpeg files Pin
Dennis Huisman31-Mar-06 5:59
Dennis Huisman31-Mar-06 5:59 
Questiongettinig insert error and need help Pin
MeterMan31-Mar-06 5:53
MeterMan31-Mar-06 5:53 
AnswerRe: gettinig insert error and need help Pin
Paradise Bride31-Mar-06 6:35
Paradise Bride31-Mar-06 6:35 
GeneralRe: gettinig insert error and need help Pin
MeterMan31-Mar-06 8:38
MeterMan31-Mar-06 8:38 
AnswerRe: gettinig insert error and need help Pin
Dave Kreskowiak31-Mar-06 9:23
mveDave Kreskowiak31-Mar-06 9:23 
MeterMan wrote:
Dim MySql As String = "Insert into ExpenseReport _
(DateRow1,WhomRow1,CCardAmountRow1,PCardAmountRow1,CashAmount,VehicleNumRow1,ProjectnameRow1, _
TypeofExpenseRow1) values " & tbxDate.Text.ToString & "," & tbxWhom.Text.ToString & "," & _
tbxCCard.Text.ToString & "," & tbxPCard.Text & "," & tbxCash.Text & "," & tbxVehicle.Text & "," & _
tbxProject.Text.ToString & "," & ddnExpense.SelectedValue.ToString



I've seen this WAY too many times... Junk like this just leads to problems that are difficult to find and opens you up to Injection attacks.

You can avoid this by using Parameterized Queries instead. Search the articles for "Sql Injection Attacks" and you'll find a great article by Colin Angus Mackay, which will detail how to do this.

Anyway, you're missing some quote marks, concantenation characters (&), parenthesisin the SQL statements, ..., and it just bugs the #&@% out of me to see people calling .ToString() on a Text property. Text returns a String, so why call .ToString() on a String?!?!?
Dim MySql As String = "Insert into ExpenseReport " & _ 
    "(DateRow1, WhomRow1, CCardAmountRow1, PCardAmountRow1, " & _
    "CashAmount, VehicleNumRow1, ProjectnameRow1, TypeofExpenseRow1)" & _
    " values (" & tbxDate.Text & "," & tbxWhom.Text & "," & _
    tbxCCard.Text & "," & tbxPCard.Text & "," & tbxCash.Text & "," & _
    tbxVehicle.Text & "," & tbxProject.Text & "," & _
    ddnExpense.SelectedValue.ToString() & ")"




RageInTheMachine9532
"...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

GeneralRe: gettinig insert error and need help Pin
MeterMan31-Mar-06 16:22
MeterMan31-Mar-06 16:22 
Questiondealing with more than table Pin
Paradise Bride31-Mar-06 5:02
Paradise Bride31-Mar-06 5:02 
QuestionCalling unmanaged function Pin
mosquitooth31-Mar-06 4:45
mosquitooth31-Mar-06 4:45 
Questionbarcode scanner Pin
SVb.net31-Mar-06 3:30
SVb.net31-Mar-06 3:30 
AnswerRe: barcode scanner Pin
J4amieC31-Mar-06 3:43
J4amieC31-Mar-06 3:43 
Question[Message Deleted] Pin
campbells31-Mar-06 2:42
campbells31-Mar-06 2:42 
GeneralRe: cant add data to access??? Pin
Guffa31-Mar-06 4:37
Guffa31-Mar-06 4:37 
AnswerRe: cant add data to access??? Pin
Vikrant Badhai31-Mar-06 21:07
Vikrant Badhai31-Mar-06 21:07 
GeneralRe: cant add data to access??? Pin
MohammadAmiry31-Mar-06 22:25
MohammadAmiry31-Mar-06 22:25 
QuestionRemoving Visual Studio 2003 Pin
MatthysDT31-Mar-06 1:43
MatthysDT31-Mar-06 1:43 
AnswerRe: Removing Visual Studio 2003 Pin
CWIZO31-Mar-06 2:17
CWIZO31-Mar-06 2:17 
GeneralRe: Removing Visual Studio 2003 Pin
MatthysDT31-Mar-06 2:26
MatthysDT31-Mar-06 2:26 
GeneralRe: Removing Visual Studio 2003 Pin
J4amieC31-Mar-06 2:33
J4amieC31-Mar-06 2:33 
GeneralRe: Removing Visual Studio 2003 Pin
Dave Kreskowiak31-Mar-06 5:35
mveDave Kreskowiak31-Mar-06 5:35 
GeneralRe: Removing Visual Studio 2003 Pin
MatthysDT2-Apr-06 20:27
MatthysDT2-Apr-06 20:27 
Questionregarding datagrid scrolling downwards Pin
Pravin H31-Mar-06 1:39
Pravin H31-Mar-06 1:39 
Questionerror msg while closing vb.net project Pin
Pravin H31-Mar-06 1:37
Pravin H31-Mar-06 1:37 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.