Click here to Skip to main content
15,925,499 members
Home / Discussions / Database
   

Database

 
GeneralRe: Connection Pin
militiaware29-Apr-06 3:48
militiaware29-Apr-06 3:48 
GeneralRe: Connection Pin
Colin Angus Mackay29-Apr-06 4:06
Colin Angus Mackay29-Apr-06 4:06 
GeneralRe: Connection Pin
Jerry Hammond29-Apr-06 5:15
Jerry Hammond29-Apr-06 5:15 
GeneralRe: Connection Pin
Colin Angus Mackay29-Apr-06 5:23
Colin Angus Mackay29-Apr-06 5:23 
QuestionHow should my database like Pin
LovelyHelp28-Apr-06 20:06
LovelyHelp28-Apr-06 20:06 
AnswerRe: How should my database like Pin
Colin Angus Mackay28-Apr-06 21:08
Colin Angus Mackay28-Apr-06 21:08 
GeneralRe: How should my database like Pin
LovelyHelp29-Apr-06 3:45
LovelyHelp29-Apr-06 3:45 
GeneralRe: How should my database like Pin
Colin Angus Mackay29-Apr-06 4:03
Colin Angus Mackay29-Apr-06 4:03 
LovelyHelp wrote:
I am actually creating my project in .net


I never doubted it.

LovelyHelp wrote:
SELECT * FROM t_userPackage INNER JOIN t_package,t_user ON t_userPackage.packageID = t_package.packageID AND userID = '" & User.Identity.Name & AND t_package.packageID=XXXXXXXXX


Using SELECT * is a bad idea - if your data model changes the application that is built on top may break becuase of columns being returned that it did not expect, or columns that no longer exist. You should always list the columns you want - This also has the potential benefit of reducing network bandwidth necessary to transmit columns that will get discarded on reaching the application.

Also, when you join two or more tables together you will often get situations where there are columns with the same name. If you list columns explicitly you get the opportunity to rename columns.

The other point about this code is that it looks like it is susceptable to a SQL Injection Attack and you don't want your database to be compromised. See here on how to prevent SQL Injection Attacks[^]

LovelyHelp wrote:
for XXXXXXXX what should I put?my program is when you click on the list, it will then run the sql command to check whethere the specific user have register/pay for the specific package.


I don't know what to put for the XXXXX because it is your application and you haven't told me how it handles products. I'll assume that your application knows the productID (because that's what the code looks like it should know)

Also, from your code it looks like the user name is the key on the user table. (I would recommend keying on a number as it is more efficient than keying on a string)

Anyway your query is very simple:
SELECT COUNT(*) FROM t_userPackage WHERE userID = @userName AND packageID = @packageID

I'm assuming that if the user pays for a package that a join beween the user and package tables will exist. That being the case, the code above will return 0 if the user has not paid for the package. It will return 1 if the user has paid for the package.

I've also used parameters in the query as a part defence against SQL Injection Attacks. In your .NET code you can add parameters to your SqlCommand object like this:
cmd.Parameters.Add("@userName", User.Identity.Name);
cmd.Parameters.Add("@productID", productID);


If any of the assumptions I have made are wrong then you will have to explain your business logic and data model further because I'm using very limited information to work out how to answer your question.

Does this help?


"On two occasions, I have been asked [by members of Parliament], 'Pray, Mr. Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able to rightly apprehend the kind of confusion of ideas that could provoke such a question."
--Charles Babbage (1791-1871)

My: Website | Blog
GeneralRe: How should my database like Pin
LovelyHelp29-Apr-06 4:31
LovelyHelp29-Apr-06 4:31 
GeneralRe: How should my database like Pin
Paul Conrad29-Apr-06 4:52
professionalPaul Conrad29-Apr-06 4:52 
GeneralRe: How should my database like Pin
Colin Angus Mackay29-Apr-06 5:11
Colin Angus Mackay29-Apr-06 5:11 
GeneralRe: How should my database like Pin
LovelyHelp29-Apr-06 5:32
LovelyHelp29-Apr-06 5:32 
GeneralRe: How should my database like Pin
LovelyHelp29-Apr-06 4:36
LovelyHelp29-Apr-06 4:36 
GeneralRe: How should my database like Pin
Colin Angus Mackay29-Apr-06 5:19
Colin Angus Mackay29-Apr-06 5:19 
GeneralRe: How should my database like Pin
LovelyHelp29-Apr-06 5:41
LovelyHelp29-Apr-06 5:41 
QuestionUrgent help from an expert! Pin
JUNEYT28-Apr-06 14:16
JUNEYT28-Apr-06 14:16 
QuestionMS Access and C# Help Pin
achrafus28-Apr-06 11:38
achrafus28-Apr-06 11:38 
AnswerRe: MS Access and C# Help Pin
Colin Angus Mackay28-Apr-06 21:14
Colin Angus Mackay28-Apr-06 21:14 
QuestionAccess Databases Pin
QC_200028-Apr-06 4:00
QC_200028-Apr-06 4:00 
AnswerRe: Access Databases Pin
Rob Graham28-Apr-06 5:41
Rob Graham28-Apr-06 5:41 
GeneralRe: Access Databases Pin
QC_200028-Apr-06 5:59
QC_200028-Apr-06 5:59 
QuestionHow to FTP a File using SQL Server 2000? Pin
pubududilena28-Apr-06 3:57
pubududilena28-Apr-06 3:57 
QuestionUnpredicted behaviour i IN clause Pin
qur28-Apr-06 2:42
qur28-Apr-06 2:42 
Questionsearch case insensitive in access Pin
klakero28-Apr-06 1:16
klakero28-Apr-06 1:16 
QuestionRe: search case insensitive in access Pin
Eric Dahlvang28-Apr-06 5:47
Eric Dahlvang28-Apr-06 5:47 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.