|
|
Figmo2 wrote: If I code my SelectCommand to look like ......WHERE Field LIKE @value It will work perfectly if I manually type the % signs in the text box for value. Including if I type %O'Hara% (the single quote no longer chokes it since I'm not concatenating anymore) - but obviously I don't want to have to teach the world to always put % sings at the start and end of their search strings on my web site.
I think this is correct functionality, it is looking for records where Field contains "%....%" rather than "....". I don't see the need to manually type the "%" in the majority of cases, it'll just confuse most [non-technical] users. Do you need to use wildcards?
|
|
|
|
|
Great suggestions all - thank you. What I ended up doing was a little different. I think elegant, but maybe not. Open to critiques...
I left the ControlParameter tied to my text box. (the parameter is called @SearchExpr)
My WHERE clause in the SelectCommand is simply "...WHERE Field LIKE @SearchExpr..." (no concatenation, thus no problems with single quotes needing to be escaped)
And added an event handler for SqlDataSource.Selecting that does this...
protected void SqlDataSource1_Selecting(object sender, SqlDataSourceSelectingEventArgs e)<br />
{<br />
e.Command.Parameters["@SearchExpr"].Value = "%" + e.Command.Parameters["@SearchExpr"].Value + "%";<br />
}
So now the user just enters ANY search string into the text box (e.g. "O'Hara")
This is passed to the SelectCommand as a parameter, thus it is not executable code - so no worries about SQL injection (I think)
And then, in the event handler, right before the SelectCommand is applied to the SqlDataSource, I modify the value to add the % signs front and back.
It works like a charm but the only thing I am not certain of is how well protected I am against injection attacks. Am I right in assuming that this should be adequate protection?
|
|
|
|
|
Figmo2 wrote: Am I right in assuming that this should be adequate protection?
You're using a parameterised query, so you should be OK on that front. However, take a look at http://msdn.microsoft.com/en-us/library/ms179859.aspx[^] for some more "magic characters" that might appear in your search string, and give unexpected results.
|
|
|
|
|
Hi All,
I had a task which is compare the customer age in the background and if he is 18+ then I have to show
him he is allowed for a new feature(this is typically a click link which in turn call another service) if he is under 18 then there is no display of new feature.
Client asked me to present that new feature to please the people who are eligible.
I have done all the background tasks except the presentation.
my code struck here
if(age>18)
{
///////////
}
Any suggestions????
Thanks
-- Modified Tuesday, October 5, 2010 10:06 AM
|
|
|
|
|
Jayadheer Reddy wrote: my code struck here
if(age>18)
{
///////////
}
use some link or linkbutton or tab according to your page need and display it in only when your condition gets true.
|
|
|
|
|
Hello I have a gridview with this form
ID_student -------exam_mark1 ------exam_mark2-----average
to calculate the average score I used this code
double average = 0;<br />
foreach (GridViewRow MRow in GridView1.Rows)<br />
{<br />
average = double.Parse(MRow.Cells[2].Text ) + double.Parse(MRow.Cells[3].Text);<br />
average = average / 2;<br />
MRow.Cells[4].Text = moyenne.ToString();<br />
}
but it returns me the following error: The format of the input string is incorrect.
Help me ,thanks
|
|
|
|
|
the Cells collection is zero-based, so you want to average Cells(1) and Cells(2) adn put the answer in Cells(3), not 2, 3 adn 4 as you have it.
But what a horrible way of doing things...on teh sassumption that these results are pulled from a database, why not pull the average directly out of that in your select statement?
Or at least calculate the average in teh RowDataBound event....
|
|
|
|
|
amina89 wrote: but it returns me the following error: The format of the input string is incorrect.
Did you try to debug your code? Debugging if for this purpose only.
As already suggested, better to do this calcaluation and assiging in rowdatabound event.
|
|
|
|
|
I still have the same error.
I forgot to say that the gridview is in edit mode for columns -exam_mark1 ,-exam_mark2 and I do not know if this is the cause.
<asp:GridView ID="GridView1" runat="server" AllowSorting="True" AutoGenerateColumns="False"<br />
BackColor="White" BorderColor="#CCCCCC" BorderWidth="1px" CellPadding="4" CssClass="th"<br />
DataKeyNames="NUM_INSCRIPTION" Width ="60%" Height="9%" PagerStyle-CssClass="note" Style="position: absolute; left: 126px; top: 159px;"<br />
><br />
<FooterStyle BackColor="White" ForeColor="#000066" /><br />
<RowStyle ForeColor="#000066" /><br />
<SelectedRowStyle BackColor="#669999" Font-Bold="True" ForeColor="White" /><br />
<PagerStyle BackColor="White" CssClass="note" ForeColor="#000066" HorizontalAlign="Left" /><br />
<HeaderStyle BackColor="#006699" Font-Bold="True" ForeColor="White" /><br />
<br />
<br />
<br />
<Columns><br />
<asp:TemplateField HeaderText="IDStudent"><br />
<ItemStyle CssClass="td00" /><br />
<ItemTemplate><br />
<asp:Label ID="lblUserID1" runat="server" Text='<%# Eval("NUM_INSCRIPTION") %>'></asp:Label><br />
<itemstyle cssclass="td00" /><br />
</ItemTemplate><br />
</asp:TemplateField><br />
<br />
<br />
<asp:TemplateField HeaderText="StudentName"><br />
<ItemStyle CssClass="td01" /><br />
<ItemTemplate><br />
<asp:Label ID="lblUserID2" runat="server" Text='<%# Eval("NOM_PRENOM_ETUDIANT_ARABE") %>'></asp:Label><br />
</ItemTemplate><br />
</asp:TemplateField><br />
<br />
<br />
<br />
<asp:TemplateField HeaderText="mark1"><br />
<ItemTemplate><br />
<asp:Label ID="lblLastName1" runat="server" Text='<%# Eval("111") %>' Visible='<%# !(bool) IsInEditMode %>'></asp:Label><br />
<asp:TextBox ID="moyt1" runat="server" Text='<%# Eval("111") %>' Visible='<%# IsInEditMode %>'></asp:TextBox><br />
</ItemTemplate><br />
</asp:TemplateField><br />
<br />
<br />
<br />
<asp:TemplateField HeaderText="mark2"><br />
<ItemStyle CssClass="td02" /><br />
<ItemTemplate><br />
<asp:Label ID="lblLastName" runat="server" Text='<%# Eval("112") %>' Visible='<%# !(bool) IsInEditMode %>'></asp:Label><br />
<asp:TextBox ID="validt1" runat="server" Text='<%# Eval("112") %>' Visible='<%# IsInEditMode %>'></asp:TextBox><br />
</ItemTemplate><br />
</asp:TemplateField> <br />
<br />
<br />
<br />
<asp:TemplateField HeaderText="average"><br />
<ItemStyle CssClass="td01" /><br />
<ItemTemplate><br />
<asp:Label ID="lblUserID4" runat="server" Text='<%# Eval("NOTE_MODULE") %>'></asp:Label><br />
</ItemTemplate><br />
</asp:TemplateField><br />
<br />
<br />
</Columns><br />
when the teacher populated the gridview he clicks insert button to insert the marks in the database and then clicks on the button average whose code is the top one.
if I use sql to calculate the average. the sql query becomes long because the pivot.if I use RowDataBound I calculate the average row by row?
thanks
|
|
|
|
|
Hi All,
Please help me regarding a doubt. i have a .xml file which is having around 3000 nodes, now I want to retrieve the name attribute of those nodes for which store attribute>30. Please suggest the esaiest way to do it.
Thanks,
Inder....
|
|
|
|
|
Load the xml with the XmlDocument and use xpath to get the nodes. Iterate those nodes the read the attribute.
Example:
<code>
XmlDocument xmlDoc = new XmlDocument();
xmlDoc.Load("XMLFile.xml");
XmlNodeList selectedNodes = xmlDoc.SelectNodes("//Store[@Stores>30]");
foreach (XmlNode item in selectedNodes)
{
Console.WriteLine(item.Attributes["name"].Value);
}
Console.ReadLine();
</code>
My xml file:
<?xml version="1.0" encoding="utf-8" ?>
<Stores>
<Store name="Name1" store="10"/>
<Store name="Name2" store="20"/>
<Store name="Name3" store="30"/>
<Store name="Name4" store="40"/>
</Stores>
|
|
|
|
|
Don't cross post! You have already asked this question in the C# forum, which is more appropriate than the ASP.NET forum but should have been placed in the XML forum
I know the language. I've read a book. - _Madmatt
|
|
|
|
|
Hi ,
We are developing a portal in asp.net (C#), where user can upload documents , We need to prevent the upload of Renamed files(the extensions changed Ex.xxxx.exe changed to xxxx.docx) , and Encrypted files(Password protected). Please advice .
Regards,
Nancy
|
|
|
|
|
You won't be able to detect whether a file name has been changed prior to upload. As for encryption, there are copious amounts of documentation covering that subject.
I know the language. I've read a book. - _Madmatt
|
|
|
|
|
One assumes you want to restrict the uploaded file types to a certian set - eg doc, docx, pdf.. whatever. So I would think it possible to examine the uploaded file/s (byte by byte) in the code-behind to at least check that its format is that of the supposed file type, according to its extension. Some research would be required to determine a reasonable test for each type, but I wouldn't have thought that that would be beyond the wit of man... or woman.
|
|
|
|
|
how do i debug when i am not getting back the querystring parameters from the browser to the server? thank you.
----------------------------------------------------------
Lorem ipsum dolor sit amet.
|
|
|
|
|
what do you mean? you can't see your parameters in the querystring or it's not even there?
Please don't forget to mark 'Good Answer', if you find it really a good one!
Kashif
|
|
|
|
|
i am not receiving it on the server side. i am actually more asking of a debugging technique/tool.
----------------------------------------------------------
Lorem ipsum dolor sit amet.
|
|
|
|
|
You can always manually type in the url with parameters to a browser. However, where is the request coming from? Is it from your own page? Then you need to determine why the query string is not being supplied.
I know the language. I've read a book. - _Madmatt
|
|
|
|
|
yes you're right that's what i'm doing is typing the url on the address bar with the query string. and it is my page. is fiddler something that would be useful in this situation? i'm talking about trapping the request/response.
----------------------------------------------------------
Lorem ipsum dolor sit amet.
|
|
|
|
|
You are going to have to elaborate. Are you using Visual Studio? You can't set a breakpoint and inspect the query string?
I know the language. I've read a book. - _Madmatt
|
|
|
|
|
Hello All,
We have the following scenario.
1. In code behind page I have defined two Page Methods.
suppose Page Method 1 executes Add funtionality of two numbers. Page Method 2 executes Substraction functionality.
2. I want those two methods to execute at the same time in parallel. When the methods are called from JavaScript, they are called in sequential order. However, those two methods Add() and Subtract() should be called in parallel to improve the performance by getting the response quickly.
Can you please shed some light on this and help us to solve this issue.
Yours Raheem MA
|
|
|
|
|
Hi,
I have Siebel On demand web service wsdl, I want to consume Siebel OD web service in my .Net console application.
I want to update Siebel OD picklist from .Net client
I can implement this from below 2 ways.
1. Add web reference and VS will automatically create proxy class.
2. Dynamically create input soap message and pass soap message across with help web service extension’s
webrequest and webresponse methods.
Please advice which one of above process will be good in performance, scalable, lightness of invocation of web service.
Thanks,
Anurag
|
|
|
|
|
No Reply ...
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
