We Keep Coding

parameterised query to prevent SQL injection [closed]

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 3 years ago.
Improve this question
can someone please help me re-write this line of code to parameterise the variable CMA_AAP_ID before it's passed to the GetList method?
public virtual IList<KGV_CMS_PHYSICAL_MAPPINGS> GetAssociatedPhysicalMappings()
{
return CMS_MAPPINGS.GetList(string.Format("from CMS_MAPPINGS as MAPPINGS where MAPPINGS.MAP_ID in ( select MAP_ID from FIELD_MAP_APP as FieldsAppls where FMA_APP_ID = {0} )", CMA_APP_ID));
}

You can try the following:
string sqlQuery = "from CMS_MAPPINGS as MAPPINGS where MAPPINGS.MAP_ID in ( select MAP_ID from FIELD_MAP_APP as FieldsAppls where FMA_APP_ID = #id";
then try the following:
using (var connection = new SqlConnection(/* some connection info */))
using (var command = new SqlCommand(sql, connection))
{
var idParameter = new SqlParameter("id", SqlDbType.int); // change here
idParameter.Value = 10;
command.Parameters.Add(idParameter);
var results = command.ExecuteReader();
}

No value given for one or more required parameters on c# [closed]

Closed. This question needs debugging details. It is not currently accepting answers.
Edit the question to include desired behavior, a specific problem or error, and the shortest code necessary to reproduce the problem. This will help others answer the question.
Closed 3 years ago.
Improve this question
this is my first time code on c# and MySQL i am sorry if my code is messy
My database is from Ms Access and i am trying to migrate all of the data into the MySQL workbench through c# application
below is my code
sqlcomm = "SELECT Product_Name,Product_ID,Product_Category,Quantity,Location,Manufacturer,Remark,QR_Code,Description,MinQuantity,Color_Type,Owner,Project_Name FROM Inventory_Management ";
adapter1 = new OleDbDataAdapter(sqlcomm, conn);
OleDbCommandBuilder builder = new OleDbCommandBuilder(adapter1);
dt1.Reset();
adapter1.Fill(dt1);
if (dt1.Rows.Count > 0)
{
DataTable dt_Tbl = new DataTable();
dt_Tbl.Columns.Add("Product_Name");
dt_Tbl.Columns.Add("Product_ID");
dt_Tbl.Columns.Add("Product_Category");
dt_Tbl.Columns.Add("Quantity");
dt_Tbl.Columns.Add("Location");
dt_Tbl.Columns.Add("Manufacturer");
dt_Tbl.Columns.Add("Remark");
dt_Tbl.Columns.Add("QR_Code");
dt_Tbl.Columns.Add("Description");
dt_Tbl.Columns.Add("MinQuantity");
dt_Tbl.Columns.Add("Color_Type");
dt_Tbl.Columns.Add("Owner");
dt_Tbl.Columns.Add("Project _Name");
for (int i = 0; i < dt1.Rows.Count; i++)
{
List<string> list = new List<string>();
DataRow r = dt1.Rows[i];
DataRow dr;
dr = dt_Tbl.NewRow();
dr = r;
dt_Tbl.Rows.Add(dr);
//string crd = r["Product_Name"].ToString();
//list.Add(r["Product_ID"].ToString());
//list.Add(r["Product_Category"].ToString());
//list.Add(r["Quantity"].ToString());
//list.Add(r["Location"].ToString());
//list.Add(r["Manufacturer"].ToString());
//list.Add(r["Remark"].ToString());
//list.Add(r["QR_Code"].ToString());
//list.Add(r["Description"].ToString());
//list.Add(r["MinQuantity"].ToString());
//list.Add(r["Color_Type"].ToString());
//list.Add(r["Owner"].ToString());
//list.Add(r["Project _Name"].ToString());
}
conn.Close();
return dt_Tbl;
}
else
return null;
}
catch (Exception ex)
{
return null;
}
}
am i missing something in the code?
any help would be appreciated
Thanks so much

You are reading the data from MS Access and creating a DataTable and loading it with the data. Now you need to write the Data Table (dt_Tbl) to MySQL database. So you need to open a connection to MySQL and run an insert command on it or use data adapter to push data to it.
You can clean up the code a bit by writing functions. Don't try to do too much in one function.
DataTable products = ReadProductsFromMSAccess();
WriteProductsToMySQL(products);

Search database for value and get info c# Forms [closed]

Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 6 years ago.
Improve this question
I have a database called "users" where user information is saved. When you login with your name and pass, your name is send to the homeform, where i want to get the "to-do list" that's saved in the database with your info. Here's my code so far:
db_connection();
MySqlCommand cmd = new MySqlCommand();
cmd.CommandText = "SELECT * FROM `user` WHERE `username`=#username AND `todo`=#todo";
So basically i need to get the todo of the user (which is sent to this form as _name) lets say admin, and display it in tbTodo.

if it is in the same form you can try using
select `user`.todo from `user` where `username` = #username
considering username is unique

If the main problem is parameters - u can use property Parameters:
cmd.Parameters.AddWithValue("#username", user);
There is an example in msdn:
SqlCommand command = new SqlCommand(commandText, connection);
command.Parameters.Add("#ID", SqlDbType.Int);
command.Parameters["#ID"].Value = customerID;
// Use AddWithValue to assign Demographics.
// SQL Server will implicitly convert strings into XML.
command.Parameters.AddWithValue("#demographics", demoXml);
try
{
connection.Open();
Int32 rowsAffected = command.ExecuteNonQuery();
Console.WriteLine("RowsAffected: {0}", rowsAffected);
}
catch (Exception ex)
{
Console.WriteLine(ex.Message);
}

C# How to get DataTable value [closed]

Closed. This question needs to be more focused. It is not currently accepting answers.
Want to improve this question? Update the question so it focuses on one problem only by editing this post.
Closed 6 years ago.
Improve this question
I still new to C# and just have 3 months plus of learning process. I would like to seeking advice on how to extract data value from my DataTable I have create for validation checking.
private void checker
{
string sqlSelect2 = "SELECT a.AccNo, a.CompanyName , a.CreditLimit, FROM Debtor a JOIN";
}
which i have named TableCehecker, i do not need to put it to gridview, just for checking purposes.
In the private void process how can I extract dataTable TableCehecker and the value?
Thank you,
Brian

You need to follow the Docs from MSDN:
SqlConnection sqlConnection1 = new SqlConnection("Your Connection String");
SqlCommand cmd = new SqlCommand();
SqlDataReader reader;
cmd.CommandText = "SELECT * FROM Customers";
cmd.CommandType = CommandType.Text;
cmd.Connection = sqlConnection1;
sqlConnection1.Open();
reader = cmd.ExecuteReader();
// Data is accessible through the DataReader object here.
DataTable dt = new DataTable();
dt.Load(reader);
sqlConnection1.Close();
You can then check whatever you want of data inside the DataTable either by querying or by looping through the rows and checking the column values.
Based on your comments, to extract values from single row:
DataRow drow = dt.Rows[0];
string value = drow.Field<string>("CompanyName");

how to pass parameter to oracle function within c# environment [closed]

Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 6 years ago.
Improve this question
I search on the net to execute oracle stored function and get the value of it
and I found something similar to this but i don't really understand it so i am not able to find out what's the error with it... please if someone can explan
whats happening after opening the connection with the database ?
public void Get_Office_Desc()
{
string oradb = "Data Source=mysource;User Id=emp;Password=00;";
var v_Office_code = Current_Office_code.Text;
string CommandStr = "F_Get_Office_Desc(:pOfficeCode)";
using (OracleConnection conn = new OracleConnection(oradb))
using (OracleCommand cmd = new OracleCommand(CommandStr, conn))
{
conn.Open();
cmd.CommandType = CommandType.StoredProcedure;
cmd.Parameters.Add(new OracleParameter("pOfficeCode", v_Office_code));
cmd.Parameters.Add("pOfficeDesc", OracleType.Char, 128);
cmd.Parameters["pOfficeDesc"].Direction = ParameterDirection.ReturnValue;
cmd.ExecuteNonQuery();
var pOfficeDesc = Convert.ToString(cmd.Parameters["pOfficeDesc"].Value);
messagebox.show(pOfficeDesc);
}
}

You need to set CommandType to StoredProcedure - like that:
cmd.CommandType = CommandType.StoredProcedure;