C#

falles01 wrote:

hey told me to not worry about sql innjection attacks at the moment because thats not what they are judging me on.

// Get the valid user name and friendly name of the favourite
int uid = this.GetUserID();
string friendlyName = this.GetFriendlyName();
// Create the SQL statement to retrieve the search criteria
string sql = string.Format("SELECT Criteria FROM Favourites "+
"WHERE UserID={0} AND FriendlyName='{1}'",
uid, friendlyName);
SqlCommand cmd = new SqlCommand(sql, this.Connection);
string criteria = cmd.ExecuteScalar();
// Do the search
sql = string.Format("SELECT * FROM Products WHERE ProductName = '{0}'",
criteria);
SqlDataAdapter da = new SqlDataAdapter(sql, this.Connection);
da.Fill(this.productDataSet);

falles01 wrote:

string sql = "select * from employees where employeeID= '" + empNamecomboBox.SelectedValue.ToString() + "' select * from Role where RoleID = '" + rolecomboBox.SelectedValue.ToString() + "')";

gajesh wrote:

I am displaying another form in one pane of splitter