|
Hi Albanian,
Cant see the difference between my code and your answer
|
|
|
|
|
a diffrence is here
"SELECT * FROM C_Registered_horses WHERE Horse_Name = " & "'" & Horse_Name.Text & "'"
open the sql quote
& "'"
set query
& Horse_Name.Text
and close sql quote
& "'"
ur code:
"SELECT * FROM C_Registered_horses WHERE Horse_Name = " & Horse_Name.Text
|
|
|
|
|
Albanian wrote: SELECT * FROM C_Registered_horses WHERE Horse_Name = " & "'" & Horse_Name.Text & "'"
See this article on why concatenating SQL queries is a huge security risk:
http://www.codeproject.com/cs/database/SqlInjectionAttacks.asp[^]
-- LuisR
Luis Alonso Ramos
Intelectix - Chihuahua, Mexico
Not much here: My CP Blog!
The amount of sleep the average person needs is five more minutes. -- Vikram A Punathambekar, Aug. 11, 2005
|
|
|
|
|
I try this code to check if a name is on a table by cheking the name if this one is entered in a asp:TextBox. This is the code -->
Protected Sub Horse_Name_TextChanged(ByVal sender As Object, ByVal e As System.EventArgs)
' Check if Horse_Name is in FEI file
Dim LUConn As SqlConnection = New SqlConnection("server=localhost;uid=sa;pwd=;database=EventMngt")
'Dim LUString As String = "SELECT * FROM C_Registered_horses WHERE Horse_Name = " & Horse_Name.Text
Dim LUComm As SqlDataAdapter
Try
LUConn.Open()
LUComm = New SqlDataAdapter("SELECT * FROM C_Registered_horses WHERE Horse_Name = " & Horse_Name.Text, LUConn)
Catch Err As Exception
MessageLabel.Text = "Horsename not found. Try again or use Passport number." & Err.Message
Finally
LUConn.Close()
MessageLabel.Text = LUString
End Try
End Sub
The aboce code is executed without no error but the faulty name is not discovered, the catch statement is not catching a error. I cant see what is wrong.
|
|
|
|
|
"SELECT * FROM C_Registered_horses WHERE Horse_Name = " & Horse_Name.Text should be
"SELECT * FROM C_Registered_horses WHERE Horse_Name = '" & Horse_Name.Text & "'"
No error is getting detected becuae you are not doing anything except opening a connection to the database. You need to execute your SQL for anything to happen.
Make your dataadapter a sqlcommand, and executereader on it (into a sqldatareader) then look inside your datareader and see if rows are returned
|
|
|
|
|
In addition to Andew's reply. You might also want to read up on SQL Injection Attacks[^] becuase your code is susceptable to attack.
My: Blog | Photos
"Man who stand on hill with mouth open will wait long time for roast duck to drop in." -- Confucious
|
|
|
|
|
I need some code in VB.Net that will get all the mac address
of all the network cards on our network. I beleive a broadcast
command would be the best way to do this. Does anyone know
where I can find some code to do this?
|
|
|
|
|
I'm not sure how to do this in VB.NET, but it would require some sort of extended procedure to do this in SQL Server. But, perhaps you posted this in the wrong forum? Oops! 
My: Blog | Photos
"Man who stand on hill with mouth open will wait long time for roast duck to drop in." -- Confucious
|
|
|
|
|
I think there should be a way to do this. In the calling program, I have a list of numbers that I'm building in an sql statement so that the statement looks like this:
"SELECT firstname FROM tblPerson WHERE personid in (9,2,4)"
that works fine, but I need to use this as a stored procedure now and I need to be able to send in "(9,2,4)" as parameter. Is there a way I can make the sql use the string by reference as regular sql like this:
SELECT firstname FROM tblPerson WHERE personid in @idlist
where @idlist is a varchar string that I passed in from my app?
My articles
BlackDice
|
|
|
|
|
Nevermind. I got it to work. i just turned the whole sql statement into a string, saved it to a variable and called exec() on the variable
My articles
BlackDice
|
|
|
|
|
Black Dice,
You can create a sql Server function that takes a delimited list as a parameter and returns a table.
then in your select list you join onto this function
SELECT firstname, lastname
FROM employee e INNER JOIN
fn_MyFUnction(@DelimitedList) f On e.ID = F.ID
"Never Code by Coincidence"
-- Andy Hunt
|
|
|
|
|
Hi all,
I have made a windows service containing a method with a sql connectstring which returns the data in a datatable.
How do I get that into a datagrid on a windows form?
I hope some one can help me out - thanx.
modified 2-Feb-21 21:01pm.
|
|
|
|
|
for this u have to make a seperate application which connects to database and show u the records in datagrid
u cant use a window service for displying records as per my knowledge...
as it is a service no an application
abhinav
|
|
|
|
|
Hi everyone,
I've a quest for you.
I have to read data from a DBF file using Microsoft Jet 4.0.
Connection and data reading are OK up to about 1045 times. From that moment,
the driver send always an exception with the message:
"System resource exceeded"
I've tried to switch to a ODBC driver (through DSN) but the problem still remains.
My machine has a WinXP SP2 installed, with SQLServer 2000 SP4.
If someone has a tip...
Thanks,
Vilmer
|
|
|
|
|
check this link
http://www.codeguru.com/forum/archive/index.php/t-24213-p-2.html
|
|
|
|
|
I found nothing about my problem in that page.
I'll try to be more explicit.
Here's a sample of my test code:
Private Shared WithEvents mtmr_Timer As Timers.Timer
Private Shared mstrPath As String
Private Shared mstrFile As String
Private Sub btnStart_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnStart.Click
If mtmr_Timer Is Nothing Then
mtmr_Timer = New Timers.Timer
End If
AddHandler mtmr_Timer.Elapsed, AddressOf CheckVariable
mtmr_Timer.Interval = 500
mtmr_Timer.Start()
End Sub
Private Shared Sub CheckVariable(ByVal source As Object, ByVal e As ElapsedEventArgs)
Dim objConn As Connection
Dim objRS As Recordset
Try
objConn = New Connection
objConn.ConnectionString = "Provider=Microsoft.Jet.OLEDB.4.0;" & _
"Data Source=" & mstrPath & ";" & _
"Extended Properties=""DBASE IV;"";"
objConn.Open()
objRS = New Recordset
objRS = objConn.Execute("SELECT top 20 * FROM " & mstrFile & " ORDER BY 1")
If Not (objRS.EOF And objRS.BOF) Then
objRS.MoveFirst()
While Not objRS.EOF
objRS.MoveNext()
End While
End If
Catch ex As Exception
mtmr_Timer.Stop()
MsgBox(ex.Message, MsgBoxStyle.Critical + MsgBoxStyle.OKOnly)
Finally
If Not (objRS Is Nothing) Then
objRS.Close()
objRS = Nothing
End If
If Not (objConn Is Nothing) Then
If objConn.State = ConnectionState.Open Then
objConn.Close()
End If
objConn.Dispose()
End If
GC.Collect()
End Try
End Sub
|
|
|
|
|
Why are you using the old (COM) ADO classes inside of .Net code?
Souldn't you be using System.Data.Oledb classes instead?
First, neither Connection nor RS are garbage collected objects, so I presume you are using some kind of wrapper around the MSADO dll. Calling GC.collect (always a bad idea unless you are absolutely certain you must) probably creates the leak, since it is likely that the wrapped com objects don't get released at the right time... (you close the RS object, but don't dispose...and since it is nulled, GC likely collects it...
Mixing COM and .Net is not a good thing, and in this case you really don't need to, since .Net classes with even better functionallity exist.
Absolute faith corrupts as absolutely as absolute power
Eric Hoffer
All that is necessary for the triumph of evil is that good men do nothing.
Edmund Burke
|
|
|
|
|
I use COM inside .NET because I am just testing ADO with dBase IV files. This sample code is just a test application.
The main application where the performance of ADO is critical is written in VBA, so I have to use standard COM objects.
During my tests, I have discovered an abnormal behaviour of my test application:
I have several standard machines (WinXP SP2, MDAC 2.8, etc...) and in one of them it works properly. It's quite strange because in that one, the driver doesn't accept file names longer than 8 chars (defined as DOS 8.3 standard names). I've checked all drivers version and it seems they are the same in every machine.
Does anyone know which package (or settings) could make this possible?
|
|
|
|
|
Hello,
I have a task to write a tool that converts the structure of a sybase database to postgre database. What are the steps I need to follow to do such converter tool? Please help with ideas and examples if possible !
Thanks
|
|
|
|
|
I remember a few years ago using a script to generate a CREATE TABLE statement. You would simply pass the table name and it would generate the statement using the required system tables: sysobjects, syscolumns, etc... Search on Google as I used in sysbase. From there you will have to modify script for postgre which I am not familiar with.
Michael
I firmly believe that any man's finest hour, the greatest fulfillment of all that he holds dear, is that moment when he has worked his heart out in a good cause and lies exhausted on the field of battle - victorious.
Vince Lombardi (1913-1970)
|
|
|
|
|
Hallo,
I use the following VC++ Code with ADO to retrieve the column name of a given table. When I look in the debugger at the order of the columns I receive, it is different from the order in my table. How is it possible?
Does anybody has an idea how I can get my columns in the order they are in my table?
ADOX::Tables *pTables;
ADOX::_TablePtr pTable;
HRESULT hr = m_pCat->get_Tables(&pTables);
if (SUCCEEDED(hr)) {
int nTablesCount = pTables->GetCount(),
nInd = 0;
// Tabelle suchen.
pTable = pTables->GetItem(COleVariant(sKategorie));
//
ADOX::Columns *pColumns;
ADOX::_ColumnPtr pColumn;
pTable->get_Columns(&pColumns);
lColumnCount = pColumns->GetCount();
// Alle Spalten abarbeiten.
for (long lColumn = 0; lColumn < lColumnCount; lColumn++) {
pColumn = pColumns->GetItem(COleVariant((long)lColumn));
_bsColumnName = pColumn->GetName();
bsColumnName = _bsColumnName.GetBSTR();
Thanks in advance.
Patrick
|
|
|
|
|
a select have no order to return the records, until you tell it to with an order by statement... it may be the same here...
TOXCCT >>> GEII power
[toxcct][VisualCalc 2.20][VisualCalc 3.0]
|
|
|
|
|
Hi all,
I have a situation where I have a table in my SQL Server 2000 database, and another table stored as a .csv file. I would like to perform a join on the two tables. Is it possible to do this without entering the data in the .csv table into the SQL Server database?
I am using C#.NET for this stuff.
Cheers,
Michael
|
|
|
|
|
I haven't tried this for a text file, but give the Link Server a try in the enterprise manager. If I remember correctly the syntax is as follows: select * from linkserver...tablename.
Michael
I firmly believe that any man's finest hour, the greatest fulfillment of all that he holds dear, is that moment when he has worked his heart out in a good cause and lies exhausted on the field of battle - victorious.
Vince Lombardi (1913-1970)
|
|
|
|
|
Hi,
Where can I find the pros and cons of migrating from MS-SQL Server 2000 to MS-SQL Server 2005.
I was actually looking at the microsoft site, but was not able to find the exact one. May be I didn't go to the right page.
Thanks,
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
