|
In c#, you don't have copies of the source code, just the compiled (IL) assemblies.
Absolute faith corrupts as absolutely as absolute power
Eric Hoffer
All that is necessary for the triumph of evil is that good men do nothing.
Edmund Burke
|
|
|
|
|
I've not been thinking so much about security earlier becouse I've not made any serious applications. But in my new project security is more important. I have some questions about this and hope you can help me. 
1. In some input textbokses I've put input validators. But those validators work whatever button is pushed in my application, not only the one that would submit the data. Is there a way to make the validator work on just one button?
2. Lets say I'm adding a new user to my db. I'll put the information written in the input textbox directly into the INSERT INTO SQL string. I've been told that this is a securyity leach since users might add SQL code into the SQL string. Is this an actual problem. If it is, how to solve it the best way?
Looking forward to any hints and help!
|
|
|
|
|
Anonymous wrote:
2. Lets say I'm adding a new user to my db. I'll put the information written in the input textbox directly into the INSERT INTO SQL string. I've been told that this is a securyity leach since users might add SQL code into the SQL string. Is this an actual problem. If it is, how to solve it the best way?
Yes it is a real problem. I do SQL Security presentations on the subject. It is always amazing to see the reaction on some people's faces when I do a live demo showing how a hacker could potentially get a complete listing of the contents of the hard drive that SQL Server sits on through a web application. And it is possible to do much much worse than that.
Anyway, here is a nice article to sort you out: SQL Injection Attacks and Tips on How to Prevent Them[^]
My: Blog | Photos
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More
|
|
|
|
|
Using text instead of a stored proc is a commercial no-no it will evntually gather insults.
Plain text is horrible for mayn reasons including maintenence nightmares.
In short its easier and more structured to put it into a stored proc and makes more sense.
Nick
I'm not an expert yet, but I play one at work. Yeah and here too.
|
|
|
|
|
Wow ! I expected the posibility of doing much harm, but not that much.
What if all inputstrings are checked? Not allowing them to contain any SQL code, and no symbols like ; and - . Would this be a way to do it?
|
|
|
|
|
That way you'll have to do manually what others have done for you already.
And you can't be sure you're doing it right.
If you don't want to use stored procedures, using parameterized queries is the way to go.
When you search for the term "parameterized queries" you should find enough articles to get you started.
Regards,
mav
|
|
|
|
|
|
Hopefully someone can help,
I have a listview box where I display my desired files. I single click on the desired file to be renamed and I rename it with a new name. My problem arises when the new name gets displayed through refreshing of my loop and display function. The problem is that when, if I rename the last file entry, everything appears to display fine. If I rename a file above the last entry (bottom entry), two of the new file names appear and the last file entry gets pushed out of the listview or disappears. After renaming, with in my folder where the files reside, the file names are exactly as they should be and the rename files are displaying the new names. The problem is just
within the displaying them.
Following is a sample of my code handler to rename file:
----------
private void lvIndivFileConversion_AfterLabelEdit(object sender,
System.Windows.Forms.LabelEditEventArgs e)
{
try
{
File.Move(Path.Combine(currentFolderPath, this.lvIndivFileConversion.FocusedItem.Text),
Path.Combine(currentFolderPath, e.Label.ToString()));
DisplayInfo(currentFolderPath); //To call folder cycle through & redisplay in LV
}
catch
{
}
}
----------
I am coding in C#. Any and all help or samples are appreciated
MikeY
|
|
|
|
|
Hi,
I have a problem ! I want to save/load an Arraylist (40 000 items (objects)) but i can't use BinaryFormatter because i'm using compact framework ...
What is the fast method ?
Thank's for your answers and sorry for my poor english (i'm french)
|
|
|
|
|
What type of objects are you storing? Classes? Structs?
|
|
|
|
|
this is a small struct (name, zip code and code) but i can use a class ... it doesn't matter
|
|
|
|
|
I am trying to read some data from Microsoft Excel 2002 with a C# windows Form. I have read that I must include a .COM in my references. Going through that process I believe that I have built up my code correctly to open a new workbook and see it on the screen. I have included the code below. When I build the code I get a message saying-
The type or namespace name 'Interop' does not exist in the class or namespace 'Microsoft.Office' (are you missing an assembly reference?)
Can anyone provide me with some guidance on this subject? Thanks
using System;
using System.Drawing;
using System.Collections;
using System.ComponentModel;
using System.Windows.Forms;
using System.Data;
using Microsoft.Office.Interop.Excel;
using System.Reflection;
using System.IO;
namespace faultmap_with_labels
{
///
/// Summary description for Form1.
///
public class Form1 : System.Windows.Forms.Form
{
private System.Windows.Forms.Button button1;
///
/// Required designer variable.
///
private System.ComponentModel.Container components = null;
public Form1()
{
//
// Required for Windows Form Designer support
//
InitializeComponent();
//
// TODO: Add any constructor code after InitializeComponent call
//
}
///
/// Clean up any resources being used.
///
protected override void Dispose( bool disposing )
{
if( disposing )
{
if (components != null)
{
components.Dispose();
}
}
base.Dispose( disposing );
}
#region Windows Form Designer generated code
///
/// Required method for Designer support - do not modify
/// the contents of this method with the code editor.
///
private void InitializeComponent()
{
this.button1 = new System.Windows.Forms.Button();
this.SuspendLayout();
//
// button1
//
this.button1.Location = new System.Drawing.Point(264, 80);
this.button1.Name = "button1";
this.button1.TabIndex = 0;
this.button1.Text = "button1";
this.button1.Click += new System.EventHandler(this.button1_Click);
//
// Form1
//
this.AutoScaleBaseSize = new System.Drawing.Size(5, 13);
this.ClientSize = new System.Drawing.Size(816, 678);
this.Controls.Add(this.button1);
this.Name = "Form1";
this.Text = "Form1";
this.ResumeLayout(false);
}
#endregion
///
/// The main entry point for the application.
///
[STAThread]
static void Main(string[] args)
{
Application.Run(new Form1());
}
private void button1_Click(object sender, System.EventArgs e)
{
// Make an instance of Excel.
Microsoft.Office.Interop.Excel.ApplicationClass excel =
new Microsoft.Office.Interop.Excel.ApplicationClass();
// Show Excel on the desktop. (fast = running in the background)
excel.set_Visible( true );
}
}
}
|
|
|
|
|
As far as I know the namespace will just be Excel. I have similar code.
You can browse the generated interop assembly and look what's in there. That will give you a definitive answer.
Wout
|
|
|
|
|
Introps are wrapper classes. These helps your com component talking with your managed code. in visual studio when you create reference of excel it automatically generates introp files for you.
try removing and creating excel reference again, this might help you.
- ashish
|
|
|
|
|
Hi everyone,
For debugging purposes I would like to write text in the console. But I am not developping a console application, but a windows application.
Is it possible to open/start the console from a windows application? If yes, could somebody please tell me how and maybe provide some C# code snipped.
I have already tried Console.WriteLine, Debug.WriteLine, Trace.WriteLine but all that writes into the debug window, it dosn't start the console like in a console application.
Any hints and suggestions would be much appreciated!! I am also open for other suggestions as long as I don't have to write into a file.
Thanks!!!
Diego
|
|
|
|
|
Why not create a normal console application and then add any forms as resource or manually like so:
Form form1 = new Form();
form1.Show()
...
regards
modified 12-Sep-18 21:01pm.
|
|
|
|
|
Hi
Thank you for your suggestion. I guess I need to be more specific.
This is my code I need to enhance: (it is in a dll)
using System;
using System.Reflection;
using System.Xml;
namespace Tecan.XRE.Modules
{
public class Logging : Tecan.XRE.XreModule , ICaller
{
public Logging()
{
}
public void SendMessage( string msg)
{
Console.WriteLine("The message is:\t{0}", msg);
}
}
}
|
|
|
|
|
To get a console window, you need to have a console application. So all you have to do is to change your application to a console application, and you get a console window.
---
b { font-weight: normal; }
|
|
|
|
|
Simply set the project type to be Console Application instead of Windows Application. You'll get the console for free and everything will work just as expected.
-- LuisR
Luis Alonso Ramos
Intelectix - Chihuahua, Mexico
Not much here: My CP Blog!
The amount of sleep the average person needs is five more minutes. -- Vikram A Punathambekar, Aug. 11, 2005
|
|
|
|
|
I was wondering how to retrieve the input and output streams for an already spawned console application, using C#. I have read about anonymous pipes, and they seem to fullfill my wish, however, I haven't got a clue how to implement them in C#, and none of the articles about piping went about getting an input/output from an already spawned app.
Any ideas?
|
|
|
|
|
Hi.
This is article about redirecting stdout/stdin/stderr using Process class:
http://www.c-sharpcorner.com/References/System.Diagnostic.Process.asp
Maybe this helps.
Tadas Sukys
|
|
|
|
|
Yeah, I've played around with the Process class, and got that to work, however.. I need to bind the stdin/stdout/stderr from an already running console process..
I can't use the Process class in the way the article explained, because my console app spawns another console window, and closes the first one. The Process class doesn't capture the newly spawned shell..
|
|
|
|
|
Anonymous pipes (API functions) can be used in c# using DllImport attribute:
[DllImport("kernel32.dll")]
static extern bool CreatePipe(out IntPtr hReadPipe,
out IntPtr hWritePipe,
IntPtr lpPipeAttributes,
uint nSize);
[DllImport("kernel32.dll")]
static extern bool PeekNamedPipe(IntPtr hNamedPipe,
IntPtr lpBuffer,
uint nBufferSize,
IntPtr lpBytesRead,
IntPtr lpTotalBytesAvail,
IntPtr lpBytesLeftThisMessage);
http://www.pinvoke.net/ - PInvoke signatures.
Tadas Sukys
|
|
|
|
|
Ok, I'll check out that API function! Thanks!
|
|
|
|
|
Hi
Where can i find the list of methods that the user32.dll file contains
I also would like to see the explanetion for each method in the dll (what does it do and what is the parameters rules).
Thx Alex
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
