parameterised query to prevent SQL injection [closed] - c#

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 3 years ago.
Improve this question
can someone please help me re-write this line of code to parameterise the variable CMA_AAP_ID before it's passed to the GetList method?
public virtual IList<KGV_CMS_PHYSICAL_MAPPINGS> GetAssociatedPhysicalMappings()
{
return CMS_MAPPINGS.GetList(string.Format("from CMS_MAPPINGS as MAPPINGS where MAPPINGS.MAP_ID in ( select MAP_ID from FIELD_MAP_APP as FieldsAppls where FMA_APP_ID = {0} )", CMA_APP_ID));
}

You can try the following:
string sqlQuery = "from CMS_MAPPINGS as MAPPINGS where MAPPINGS.MAP_ID in ( select MAP_ID from FIELD_MAP_APP as FieldsAppls where FMA_APP_ID = #id";
then try the following:
using (var connection = new SqlConnection(/* some connection info */))
using (var command = new SqlCommand(sql, connection))
{
var idParameter = new SqlParameter("id", SqlDbType.int); // change here
idParameter.Value = 10;
command.Parameters.Add(idParameter);
var results = command.ExecuteReader();
}

Related

ExecuteReader() Object cant be converted [closed]

Closed. This question is not reproducible or was caused by typos. It is not currently accepting answers.
This question was caused by a typo or a problem that can no longer be reproduced. While similar questions may be on-topic here, this one was resolved in a way less likely to help future readers.
Closed 6 years ago.
Improve this question
I have set up a mySql database on a server, and now i want to reach it in order for me to make a webservice. Firstly i just want to test if i can grab an entity from my query in my method (OneEntity), and put it into my list.
public IEnumerable<Person> Get()
{
return new List<Person> {
new Person{ ID = 0, First = OneEntity(), Last ="Example"}
};
}
public string OneEntity()
{
MySql.Data.MySqlClient.MySqlConnection mySqlConnection;
MySql.Data.MySqlClient.MySqlCommand cmd;
String connString = System.Configuration.ConfigurationManager.ConnectionStrings["MySql"].ToString();
mySqlConnection = new MySql.Data.MySqlClient.MySqlConnection(connString);
cmd = new MySql.Data.MySqlClient.MySqlCommand();
cmd.CommandText = "SELECT 'name' FROM 'CustomerDb' WHERE 'id' = 0";
cmd.CommandType = CommandType.Text;
cmd.Connection = mySqlConnection;
mySqlConnection.Open();
SqlDataReader reader = cmd.ExecuteReader();
mySqlConnection.Close();
return reader;
}
I am not very experienced in c# and are therefore not sure if im doing it correct. However in my cmd.ExecuteReader() (Object i guess it is?!??!) i get that it
cannot implicitly convert type 'MySql.Data.MySqlDataReader' to
'System.Data.SqlClient.SqlDataReader'
What am i doing wrong here?? obviously my return is not correct either, as i specified my method to be 'string'.. but even though i type in a string, the error doesn't dissapear?
you shoud use MySqlDataReader not SqlDataReader
MySqlDataReader Reader = cmd.ExecuteReader();
code should return string not the reader in your case.
To return the first item use this return reader.GetString(0);

how to pass parameter to oracle function within c# environment [closed]

Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 6 years ago.
Improve this question
I search on the net to execute oracle stored function and get the value of it
and I found something similar to this but i don't really understand it so i am not able to find out what's the error with it... please if someone can explan
whats happening after opening the connection with the database ?
public void Get_Office_Desc()
{
string oradb = "Data Source=mysource;User Id=emp;Password=00;";
var v_Office_code = Current_Office_code.Text;
string CommandStr = "F_Get_Office_Desc(:pOfficeCode)";
using (OracleConnection conn = new OracleConnection(oradb))
using (OracleCommand cmd = new OracleCommand(CommandStr, conn))
{
conn.Open();
cmd.CommandType = CommandType.StoredProcedure;
cmd.Parameters.Add(new OracleParameter("pOfficeCode", v_Office_code));
cmd.Parameters.Add("pOfficeDesc", OracleType.Char, 128);
cmd.Parameters["pOfficeDesc"].Direction = ParameterDirection.ReturnValue;
cmd.ExecuteNonQuery();
var pOfficeDesc = Convert.ToString(cmd.Parameters["pOfficeDesc"].Value);
messagebox.show(pOfficeDesc);
}
}
You need to set CommandType to StoredProcedure - like that:
cmd.CommandType = CommandType.StoredProcedure;

c# to Access INSERT INTO query not working [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
Closed 7 years ago.
This question was caused by a typo or a problem that can no longer be reproduced. While similar questions may be on-topic here, this one was resolved in a way less likely to help future readers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Improve this question
I am trying to enter the value of a textbox in c# into a field in a database that I have in access. For some reason I keep getting the error saying:
'An unhandled exception of type 'System.Data.OleDb.OleDbException' occurred in System.Data.dll
Additional information: Syntax error in INSERT INTO statement.'
Can't quite see what is wrong, this is the first time I have attempted to do this in a project so I am not too experienced with it. This is my code:
OleDbConnection connection = new OleDbConnection(CONNECTION STRING GOES HERE);
connection.Open();
string playerName = textBox[i].Text;
string query = "INSERT INTO (TotalPlayerName)(Player Name) VALUES(" + playerName + ")";
OleDbCommand command = new OleDbCommand(query, connection);
command.ExecuteNonQuery();
if it helps then the database is called 'Database' the table is called 'TotalPlayerName' and the field is called 'Player Name'
The correct code to do your task is
string cmdText = "INSERT INTO TotalPlayerName ([Player Name]) VALUES(?)";
using(OleDbConnection connection = new OleDbConnection(...))
using(OleDbCommand command = new OleDbCommand(cmdText, connection))
{
connection.Open();
command.Parameters.Add("#p1", OleDbType.VarWChar).Value = textBox[i].Text;
int result = command.ExecuteNonQuery();
if(result > 0)
MessageBox.Show("Record Inserted");
else
MessageBox.Show("Failure to insert");
}
This approach fixes three problems:
The connection and the command object should be disposed at the end
(see using statement)
Every value that you need to pass to the query should be passed as
parameter
If a field name (or table name) has embedded spaces you should enclose
it between square brackets
(The messages below the ExecuteNonQuery are there only as an example to check the return value of ExecuteNonQuery)
Remember also that if your table has more than this field and some of the other fields don't accept null values you should provide some value also for them.
For example
string cmdText = #"INSERT INTO TotalPlayerName ([Player Name], FieldB)
VALUES(?, ?)";
command.Parameters.Add("#p1", OleDbType.VarWChar).Value = textBox[i].Text;
command.Parameters.Add("#p2", OleDbType.VarWChar).Value = "ValueForFieldB";
Just remember to strictly follow the order of the ? when you add your parameter values

Oracle: Bulk update of records from c# [closed]

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 8 years ago.
Improve this question
I have a requirement where I have to perform bulk update of records in Oracle using c#. I'm trying to achieve this by passing an array of record ids that have to be updated back to oracle,but the code is not working.
The latest code that I have used is-
List<Int64> listTransId = new List<Int64>();
while (reader.Read())
{
listTransId.Add(Convert.ToInt64(reader["TOLL_TX_SEQ_NUM"]));
}
Int64[] arrTOLL_TX_SEQ_NUM = new Int64[listTransId.Count];
arrTOLL_TX_SEQ_NUM = listTransId.ToArray();
OracleTransaction txn = connection.BeginTransaction(IsolationLevel.ReadCommitted);
OracleCommand updateCmd = new OracleCommand(#" BEGIN UPDATE TOLL_TRANSACTION SET CCH_EXPORT_DATETIME = SYSDATE WHERE TOLL_TX_SEQ_NUM = :TOLL_TX_SEQ_NUM; END;");
updateCmd.CommandType = CommandType.Text;
updateCmd.Connection = connection;
//update Cmd.BindByName = true;
update Cmd.ArrayBindCount = arrTOLL_TX_SEQ_NUM.Length;
OracleParameter TOLL_TX_SEQ_NUM = new OracleParameter("TOLL_TX_SEQ_NUM", OracleDbType.Int64);
TOLL_TX_SEQ_NUM.Direction = ParameterDirection.Input;
TOLL_TX_SEQ_NUM.CollectionType = OracleCollectionType.PLSQLAssociativeArray;
TOLL_TX_SEQ_NUM.Value = arrTOLL_TX_SEQ_NUM;
TOLL_TX_SEQ_NUM.Size = arrTOLL_TX_SEQ_NUM.Length;
updateCmd.Parameters.Add(TOLL_TX_SEQ_NUM);
Console.WriteLine("Connection state - " + connection.State);
updateCmd.ExecuteNonQuery();
txn.Commit();
connection.Close();
use "array binding" with a simply update statement.
http://www.oracle.com/technetwork/issue-archive/2009/09-sep/o59odpnet-085168.html

how to pass stored procedure value into a webform? [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
Questions asking for code must demonstrate a minimal understanding of the problem being solved. Include attempted solutions, why they didn't work, and the expected results. See also: Stack Overflow question checklist
Closed 9 years ago.
Improve this question
I am fresher,i was created a stored procedure for my sql table and i wanted to display those data into a aspx page..
i need the code for..ajax,js,asp.net
From the top of my head like this:
using (SqlConnection con = new SqlConnection(ConnectionString)) {
con.Open();
using (SqlCommand command = new SqlCommand("ProcedureName", con)) {
command.CommandType = CommandType.StoredProcedure;
using(SqlReader reader = command.ExecuteReader()){
if (reader.HasRows) {
while(reader.Read()) {
... process SqlReader objects...
}
}
}
}
}
EDIT: sorry, missed the "retrieve" info.

Categories