|
Alright, I'm about ready to yank what's left of my hair out. Hopefully someone out there has the answer to my problem. Here it is…
I want to allow users to type any damn fool thing they want into a text field and then store that string in a database. I don’t like the idea of disallowing certain characters. I’d like to figure a way to store any string in the database regardless of what silly characters the user inputs.
I’ve done quite a bit of looking around on the internet for the answer to this problem. Surprisingly no one seems to have a good answer. I thought this would be easy and that I would find a viable answer right away. I have to admit that I am a little disappointed with the development community as a whole right now. For shame!
Anyway, I figured out how to deal with apostrophes and “single-qoutes”. ‘ this character whatever you call it anyway. If you simply double-up an apostrophe in a SQL query, for example: the string “Mr. O’Connell” would be changed to “Mr. O’’Connell”. This seems to work fine. Here’s the problem that’s killing me, what if the string was “Mr. O”Connell”, now what do you do. Obviously, it would be stupid to use a quotation mark it this way, but I want to allow users to indulge their stupidity. How in the heck do you put that in a SQL query without invoking a database error? Also, what about other special characters like: \ @ # $ % and so on. What if the string was something like this “Mr. “\@#$’%”. There has got to be an answer.
Not that it matters a whole lot, but the application is written in VB.Net and I am querying against a MS Access database. Access is just for now, when the application is finished users will have the option of several different providers such as: Access, SQL Server or My SQL.
Please Help
|
|
|
|
|
If you use parameters in your query you should get around this problem. No?
"If a man empties his purse into his head, no man can take it away from him, for an investment in knowledge pays the best interest." -- Joseph E. O'Donnell
Not getting the response you want from a question asked in an online forum: How to Ask Questions the Smart Way!
|
|
|
|
|
Could you give me an example?
|
|
|
|
|
|
Well, stop writing SQL Insert / Update Queries and start using Objects. ADO (and now ADO.NET) lets you enter any damn thing you want into the DB! It has for many years! 
|
|
|
|
|
Yea, But I hate datasets. They just seem so redundant to me. I already have a database so what's the point of making a copy of the tables in code. I already have tables, there in the database. Plus, I've already got everything working, so to change everything over to use those silly datasets would take a lot of time that I don't have. Sending Non-Queries and using data readers is faster anyway.
|
|
|
|
|
And why are you stiking your tounge out at me. That's not nice. 
|
|
|
|
|
I used to think exactly like you. The point is not redundancy though, it's ease of programability (I think I just made that word up) and also being able to handle unforseen problems before they even occur (i.e. handling any character).
Did you know that you can bind DataAdapters to Stored Procs and also bind the Parameters of the Stored Procs to Columns in DataSets?
But, whatever floats your boat. You might want to Build seperate routines then for Save and Delete operations that use DataCommand Objects.
|
|
|
|
|
mikasa wrote:
Did you know that you can bind DataAdapters to Stored Procs and also bind the Parameters of the Stored Procs to Columns in DataSets?
You know, I just discovered that earlier today. I'm almost sold of the idea that datasets are acceptable. Once the typed datasets are sorted out, and apparently there are vast improvements in this area in .NET 2.0, I might actually "like" them.
"If a man empties his purse into his head, no man can take it away from him, for an investment in knowledge pays the best interest." -- Joseph E. O'Donnell
Not getting the response you want from a question asked in an online forum: How to Ask Questions the Smart Way!
|
|
|
|
|
I'm with you there. In VB6, I never used databinding! I hated it and it was flaky. Now, however, .NET has made vast improvements with DataBinding! I've been able to Code Business Layers and UIs with very little code at all! Not only that, it's great having the ability to Map DataColumns to DataCommand Parameters and be able to use Stored Procs to update data. And it doesn't stop there, you can even get Values from the DB with "Output" Parameters! 
|
|
|
|
|
Use of special characters in datatable.select(sql):
Encapsulate each of these special chars with "[" and "]".
e.g
[ will become [[]
] will become []]
% will become [%]
so "text [abc] test" should look like "text [[]abc[]] test"
The simple use of string.replace will not help:
.Replace("[","[[]").Replace("]","[]]")
will produce: "text [[[]]abc[]] test" (not really what we expected).
Esp. for brackets you will have to go through some special "escapes":
.Replace("[","<ESCAPE FOR OPEN>").Replace("]","<ESCAPE FOR CLOSE>").Replace("<ESCAPE FOR OPEN>","[[]").Replace("<ESCAPE FOR CLOSE>","[]]")
worked fine for me.
|
|
|
|
|
Hi,
I am working on the guestbook in VB.NET with SQL db. I have a database for registered users, there are names, surnames, and mainly paths to user-defined images, which they want them to be seen together with their comments.
I have two possibilities how to do it:
1)I will authentify the user with the user control, load the guestbook.aspx - I will get all data from table GUESTBOOK only, when user submits the form, I will get the ImagePath from db and save the name, comment, AND IMAGEPATH to db table GUESTBOOK. I think this way is faster during the guestbook.aspx load, but I have to save the same ImagePaths each time the user sends the comment.
2)I will authentify the user with the user control, load the guestbook.aspx - I will get the names and comments from table GUESTBOOK and ImagePaths based on usernames from USERS table. When user submits the form, I will only save the GUESTBOOK table, not more.
What's better - faster?
|
|
|
|
|
I've got a database, it's not set up with cascading delete, and I'd prefer it not be. Instead, I'd like to turn of foreign key checking when I delete all data from all the tables. Is there a way to delete all data without figuring out the correct delete order, by getting SQL Server to ignore the constraints ?
Christian
I have drunk the cool-aid and found it wan and bitter. - Chris Maunder
|
|
|
|
|
I am currently using the following statement to read data from a table, column
my_String = _strdup((char*) ((_bstr_t)(pConnectRead->GetFields()->GetItem("nom_medico")->GetValue())) );
How do i write data to this column?
Please help,
THanks
Ed Rey
|
|
|
|
|
pConnectRead->GetFields()->GetItem("nom_medico")->Value = (LPCTSTR)my_String;
pConnectRead->Update();
Sanjay Sansanwal
www.sansanwal.com
|
|
|
|
|
I am referencing the libraries from msado15.dll and retreiving data from an access database using visual C++. I have already connected succesfully to the DB, and can read data. I use the following command to retreive information from a particular field in the table:
my_String = _strdup((char*) ((_bstr_t)(pConnectRead->GetFields()->GetItem("nom_medico")->GetValue())) );
How do i write a boolean value to a field, once i have established connection to the DB and currently in the row of interest.
Eduardo M. Rey
|
|
|
|
|
if(Condition is true)
pConnectRead->GetFields()->GetItem("nom_medico")->Value = true;
else
pConnectRead->GetFields()->GetItem("nom_medico")->Value = false;
pConnectRead->Update();
Sanjay Sansanwal
www.sansanwal.com
|
|
|
|
|
Thanks for your prompt reply,
I am using the statement you provided:
pConnectRead->GetFields()->GetItem("nom_medico")->Value = false;
within a try-catch loop. but it jumps to the _com_error as soon as it executes this statement. Maybe i am giving the wrong premissions in the statement right before:
pConnectRead->Open(commandString, strConectIt, adOpenStatic, adLockReadOnly, adCmdText);
Thanks again for your help, you were extremely helpful.
Ed
Eduardo M. Rey
|
|
|
|
|
Hi,
I've got a table (whith an index on the CarId field (IdentityIncrement). Now I'd like to write a stored procedure which inserts a new record into this table and returns the CarId of the newly generated record. But I don't know how to do this w/o using a SELECT after the INSERT. Can anyone pls. help?
Thanks in advance.
Matthias
If eell I ,nust draw to your atenttion to het fakt that I can splel perfrectly well - i;ts my typeying that sukcs.
(Lounge/David Wulff)
www.emvoid.de
|
|
|
|
|
Create your stored procedure specifying which parameter(s) is/are output parameters like this
CREATE PROCEDURE GetInformation
(
@SomeKey int,
@SomeResult int OUTPUT
)
AS
SELECT @SomeResult = AnswerField
FROM MyTable
WHERE ThePrimaryKey = @SomeKey
GO
Then in your .NET application when you specify the parameters for the stored procedure, make sure you specify which parameter(s) is/are output.
SqlParameter someResult = new SqlParameter("@SomeKey", SqlDbType.Int);
someResult.Direction = ParameterDirection.Output;
When you have run your query, you can then get the value of the output parameter with
int result = (int)someResult.Value;
Does this help?
"If a man empties his purse into his head, no man can take it away from him, for an investment in knowledge pays the best interest." -- Joseph E. O'Donnell
Not getting the response you want from a question asked in an online forum: How to Ask Questions the Smart Way!
|
|
|
|
|
After the insert @@identity will contain the new CarId value.
e.g.
CREATE PROCEDURE InsCar
@carType int
AS
BEGIN
insert into car ( CarType, AddDtTm ) values( @carType, GetDate() )
select @@identity as UID
END
GO
[EDIT]
... or, instead of 'select @@identity ...' specify an OUTPUT parameter as Colin mentioned.
[/EDIT]
...cmk
Save the whales - collect the whole set
|
|
|
|
|
hi all,
i want to run the below query on a Ms-Access database
CREATE TABLE products (
product_no integer PRIMARY KEY,
name text,
price numeric DEFAULT 9.99
);
when i run it, its seems that access doesnt like the DEFAULT 9.99 for some reason
however if i run the query in SQL Server it works fine, but i need to run it on
an access database
ne1 any ideas of a way round this ???
thanks
si
|
|
|
|
|
You can use the MS-Access table designer screen to set the column's default value.
If you want to do this programatically then try using the "Default" property in the ADOX Column Properties collection. The SQL syntax in MS-Access does not seem to support this.
Andy
|
|
|
|
|
You need to make Access Table/Queries compatiable with SQL ANSI.
Go to Tools -> Options -> Table/Queries Tab
Now, check the "This database" checkbox under "SQL Server compatiable syntax" option on bottom right side.
Now, you would be able to run this query.
Sanjay Sansanwal
www.sansanwal.com
|
|
|
|
|
Hiya I have a script that I want run when installing my app.
How do I do this??
Thanks.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
