Click here to Skip to main content
15,888,610 members
Home / Discussions / C#
   

C#

 
GeneralRe: query to a xml database Pin
devilonline120-Feb-20 8:59
devilonline120-Feb-20 8:59 
GeneralRe: query to a xml database Pin
Richard Deeming21-Feb-20 0:55
mveRichard Deeming21-Feb-20 0:55 
AnswerRe: query to a xml database Pin
F-ES Sitecore19-Feb-20 23:08
professionalF-ES Sitecore19-Feb-20 23:08 
AnswerRe: query to a xml database Pin
Alkimus15-Mar-20 5:16
professionalAlkimus15-Mar-20 5:16 
QuestionSystem.Web.Services.Protocols.SoapException: Format of the initialization string does not conform to specification starting at index 97. Pin
Member 1474982719-Feb-20 15:36
Member 1474982719-Feb-20 15:36 
QuestionHow to do left and inner join in same query Pin
Mou_kol19-Feb-20 9:34
Mou_kol19-Feb-20 9:34 
AnswerRe: How to do left and inner join in same query Pin
Gerry Schmitz19-Feb-20 12:13
mveGerry Schmitz19-Feb-20 12:13 
GeneralRe: How to do left and inner join in same query Pin
Mou_kol21-Feb-20 22:42
Mou_kol21-Feb-20 22:42 
QuestionBest deployment guide for our winform application using CI/CD Pin
Mou_kol18-Feb-20 8:24
Mou_kol18-Feb-20 8:24 
AnswerRe: Best deployment guide for our winform application using CI/CD Pin
Richard MacCutchan18-Feb-20 10:25
mveRichard MacCutchan18-Feb-20 10:25 
QuestionSystem.FormatException: 'Input string was not in a correct format. Pin
OsvaldoFernandoQueta17-Feb-20 17:43
OsvaldoFernandoQueta17-Feb-20 17:43 
AnswerRe: System.FormatException: 'Input string was not in a correct format. Pin
OriginalGriff17-Feb-20 20:35
mveOriginalGriff17-Feb-20 20:35 
GeneralRe: System.FormatException: 'Input string was not in a correct format. Pin
kalberts17-Feb-20 23:17
kalberts17-Feb-20 23:17 
QuestionI want to open PDF-file on winforms axAcroPDF1.src (Adobe Reader) Pin
Member 1462552315-Feb-20 1:32
Member 1462552315-Feb-20 1:32 
AnswerRe: I want to open PDF-file on winforms axAcroPDF1.src (Adobe Reader) Pin
Eddy Vluggen15-Feb-20 2:59
professionalEddy Vluggen15-Feb-20 2:59 
QuestionDifferent value from input Pin
chipp_zanuff14-Feb-20 6:15
chipp_zanuff14-Feb-20 6:15 
AnswerRe: Different value from input Pin
OriginalGriff14-Feb-20 6:32
mveOriginalGriff14-Feb-20 6:32 
GeneralRe: Different value from input Pin
chipp_zanuff14-Feb-20 17:48
chipp_zanuff14-Feb-20 17:48 
GeneralRe: Different value from input Pin
OriginalGriff14-Feb-20 20:21
mveOriginalGriff14-Feb-20 20:21 
AnswerRe: Different value from input Pin
Eddy Vluggen14-Feb-20 6:35
professionalEddy Vluggen14-Feb-20 6:35 
Questionauto fill data by using 3 layer in aso.net c# Pin
Member 1474357913-Feb-20 22:47
Member 1474357913-Feb-20 22:47 
AnswerRe: auto fill data by using 3 layer in aso.net c# Pin
OriginalGriff13-Feb-20 23:39
mveOriginalGriff13-Feb-20 23:39 
Look, it really doesn't matter where you post this: as long as you are not listening to us, you will still be vulnerable to sQL injection.

So I'll say it for the third time in two days:

Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
SQL
DROP TABLE MyTable;
A perfectly valid "delete the table" command
SQL
--'
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

If you don't listen to what we tell you, there really isn't any point in talking to you ...
"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
AntiTwitter: @DalekDave is now a follower!

QuestionWhat is the correct way to do Business Validation on entities? Pin
Bastien Vandamme11-Feb-20 15:00
Bastien Vandamme11-Feb-20 15:00 
AnswerRe: What is the correct way to do Business Validation on entities? Pin
Gerry Schmitz11-Feb-20 19:48
mveGerry Schmitz11-Feb-20 19:48 
GeneralRe: What is the correct way to do Business Validation on entities? Pin
Richard Deeming11-Feb-20 23:47
mveRichard Deeming11-Feb-20 23:47 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.