posted                   

quote:

---

And an "SQL Insertion Attack" is only an issue if he isn't filtering the string before using it in an actual query.

---

Posts: 37449 | Registered: May 1999  |  IP: Logged | 

posted             

code:

---

under AppSettings

<AppSettings>
	<add Key= "ConnectionString" value="Provider=Microsoft.Jet.OLEDB.4.0;user id=Admin;Data Source=C:\...">
	            ^willuse nameti get code
	<add Key= "MyLang" value="French">
				
</appSettings>

code for show behind on the button:

Dim myobj As New clsGeneral
Dim dt As Data.DataTable
     ^-> local pointer
dt=myobj.GetQuery("select... from where " & textbox1.text)
          ^-> function/method
Gridview1.datasource=dt
gridview1.databind()


'on a datagrid it is always 2 steps

Class
-------

You RightClick and add class to program


imports Microsoft.VsualBasic
Imports System.data
imports system.configuration


in the class

Public function GtQuery( ByVal qry As String ) as Datatable 
													^return type
													
	Dim dt as Datatable               //your connection
	Dim objcmd as new oledbcommand   //your sql
	dim objdatareader as oledataReader //your answer
	        ^--> your catcher of results of sql
//set up connection

dim connstr as string
connstr = configurationsettings.Appsettings("connectionstring")
objconn.connectionstring=connstr

objconn.open()


//set up the command

objcmd.commandtext=qry

//the objcmd knows now what to do but how does it know on what database?

objcmd.connection = objconn

//aha! no objcmd knows.
//now we run the command and somehing jas to hold the results

objdatareader=objcmd.executereader(commandbehavior.closeconnection)
   ^            ^-----^-->means run the command.'
   |    			in the .commandtext property
   your results	
 //mess: your datareader must be converted
 // to a datatable before it can be sent
 // back to the datagrid (this is gridview1's datasource

	dt=maketablefromreader(objdatareader) //a method i'll write
	return dt

end function // end of methd

---

IP: Logged | 

posted                   

code:

---

objdatareader.Open()
If objdatareader.Read() Then
txtFieldname.Text = objdatareader("Fieldname")
End If
objdatareader.Close()

---

Posts: 37449 | Registered: May 1999  |  IP: Logged | 

posted                   

quote:

---

Originally posted by Blayne Bradley:
this isnt for an actual website its more inregards to my milestone III but my notes on the matter aren't presiely clear on how to get a textbox to display the results of a query.

The code would read it as

SQLstm (or qry) = ("select * from tablename WHERE" & textbox1.text & ";")

---

code:

---

I killed your table'; drop table tablename--

---

Posts: 12266 | Registered: Jul 2005  |  IP: Logged | 

posted                   

quote:

---

Originally posted by MrSquicky:
I think you might be thinking of mu.

It looks to me like you don't understand what meta means. Using it or other basic terminology can be a semi-serious problem in programming, because many people are going to take that as a sign that you don't generally know what you are doing.

If you use meta incorrecly in a job interview, for example, it is likely going to be a black mark against you.

---

quote:

---

Originally posted:
its an harddisk assignment, the actual assignment will never see the light of day on the net so SQL/html injection is not an issue at this stage security will be discussed at a later date.

---

Posts: 3486 | Registered: Sep 2002  |  IP: Logged | 

posted                   

quote:

---

I've been programming for over twenty years and I don't think I have *ever* used the word "meta" in conversation.

---

Posts: 10177 | Registered: Apr 2001  |  IP: Logged | 

posted                   

quote:

---

I've been programming for over twenty years and I don't think I have *ever* used the word "meta" in conversation.

---

Posts: 3275 | Registered: May 2007  |  IP: Logged | 

posted                   

quote:

---

Originally posted by TomDavidson:
Why would "meta" come up in conversation, Squicky? Once you know the concept, it's not like you need to talk about it -- especially during a job interview.

---

Well, if you think it's a cool sounding word, but you don't know what it really means, you might be likely to use it in contexts where it's not actually appropriate, such as in the title of this thread or in a job interview.

Posts: 3275 | Registered: May 2007  |  IP: Logged | 

posted                   

quote:

---

Originally posted by MrSquicky:

quote:

---

I've been programming for over twenty years and I don't think I have *ever* used the word "meta" in conversation.

---

I'm going to make a couple of guesses. 1) You're self-taught. 2) You've never worked with interpreted languages. How'd I do?

---

Right on #1, wrong on #2... 50%... FAIL!

Posts: 3486 | Registered: Sep 2002  |  IP: Logged | 

posted                   

quote:

---

A lot of my customers simply don't care much about SEO, no matter what I tell them.

---

Posts: 10177 | Registered: Apr 2001  |  IP: Logged | 

posted                   

quote:

---

Originally posted by Nighthawk:
As far as SQL injection... if you turned that in and the teacher doesn't point out the obvious flaw, your teacher's a tool. If I were the teacher, I'd take that flaw and beat you over the head with it; it's a fundamental necessity to know things like that, moreso than syntax or a lot of other things they might teach you. If you do such a mistake in the real world and someone exploits it, you will get fired or sued.

Besides, don't students go the extra mile anymore? Wouldn't it be nice to acknowledge the potential injection and do something about it first? You think your teacher won't notice your effort to do things right from the start?

---

Posts: 12266 | Registered: Jul 2005  |  IP: Logged | 

posted                  

quote:

---

You wouldn't beleive some of the crazy requests one of my clients has been making due to their SEO consultants recommendations.

---

Posts: 26071 | Registered: Oct 2003  |  IP: Logged | 

posted                   

quote:

---

We remapped .html to so it would be treated as .asp on the client's server at his insistence once.

---

quote:

---

We kept the whole query string after the "?" because the client was convinced it was just the extension that mattered. All attempts at explaining why this wouldn't help were futile.

---

Posts: 3486 | Registered: Sep 2002  |  IP: Logged | 

posted             

code:

---

        Dim dt As Data.DataTable
        Dim dt2 As Data.DataTable
        Dim myobj As New mile2class

        dt = myobj.GetQuery("select * from customer;")

        DDLcu_code.DataSource = dt
        DDLcu_code.DataValueField = "cu_code"
        DDLcu_code.DataBind()

        dt2 = myobj.GetQuery("select * from customer;")

        DDLcu_name.DataSource = dt2
        DDLcu_name.DataValueField = "cu_name"
        DDLcu_name.DataBind()

---

IP: Logged | 

posted             

code:

---

Imports Microsoft.VisualBasic
Imports System.Data
Imports System.Configuration


Public Class mile2class

    Public Function GetQuery(ByVal qry As String) As DataTable

        Dim dt As DataTable
        Dim objcmd As New OleDb.OleDbCommand
        Dim objdatareader As OleDb.OleDbDataReader

        Dim connstr As String
        Dim objconn As New OleDb.OleDbConnection
        connstr = System.Configuration.ConfigurationManager.AppSettings("ConnectionString")
        objconn.ConnectionString = connstr
        objconn.Open()

        objcmd.CommandText = qry
        objcmd.Connection = objconn

        objdatareader = objcmd.ExecuteReader(CommandBehavior.CloseConnection)

        dt = MakeTableFromReader(objdatareader)
        Return dt

    End Function

---

IP: Logged |