Click here to Skip to main content

C#

Re: Custom TabPage Control

tpedersen806-Dec-06 13:04

6-Dec-06 13:04

Hello!

You can try this. It's a great control with the look and feel of VS2005.

Regards

Re: Custom TabPage Control

t4ure4n6-Dec-06 22:56

6-Dec-06 22:56

Thanks very much bro.... Cool | :cool:

Cool | :cool:

Cool | :cool:

Cool | :cool:

Cool | :cool:

o O º(`'·.,(`'·., ☆,.·''),.·'')º O o°
»·'"`»* *☆ t4ure4n ☆* *«·'"`«
°o O º(,.·''(,.·'' ☆`'·.,)`'·.,)º O o°

How to access Temp Folder of System.

h@s@n6-Dec-06 5:07

6-Dec-06 5:07

Hi everyone!

I am using Windows XP. I want my program to save a file into windows temporary folder under the local settings of the current user.

1. How I can do that?
2. How I can create hexa-decimal array generated name of these files and discard them after use.

Thank you.

Re: How to access Temp Folder of System.

Pete O'Hanlon6-Dec-06 5:11

6-Dec-06 5:11

Use System.IO.Path.GetTempFileName()

Arthur Dent - "That would explain it. All my life I've had this strange feeling that there's something big and sinister going on in the world."
Slartibartfast - "No. That's perfectly normal paranoia. Everybody in the universe gets that."

Deja View - the feeling that you've seen this post before.

Re: How to access Temp Folder of System.

h@s@n6-Dec-06 5:29

6-Dec-06 5:29

Thank you.

Database Code Generator

mfcuser6-Dec-06 3:02

6-Dec-06 3:02

I want to know if there is a software that can generate sql statement for c#. All that I want to do for example, assume that I want to insert a value from a textbox,

<br />
sqlStatement = "INSERT INTO TableName(FieldName" +<br />
                "VALUES('ValueFieldName'";<br />

Now if my value field name comming from a textBox for example, then the code will change to

<br />
<br />
sqlStatement = "INSERT INTO TableName(FieldName" +<br />
                "VALUES('" + textBox.Text + "'";<br />

Re: Database Code Generator

~~_{lost in transition}~~ 6-Dec-06 3:19

~~_{lost in transition}~~

6-Dec-06 3:19

mfcuser wrote:
sqlStatement = "INSERT INTO TableName(FieldName" +
"VALUES('ValueFieldName'";

Add the ")" at the end of 'FieldName'
Also, at the end of the SQL statement.

mfcuser wrote:
sqlStatement = "INSERT INTO TableName(FieldName" +
"VALUES('" + textBox.Text + "'";

Add the ")" at the end of 'FieldName'
Also, at the end of the SQL statement.

If your SQL statement is not working that is probly why.

Programmer: A biological machine designed to convert caffeine into code. * Developer: A person who develops working systems by writing and using software.
[^]

Re: Database Code Generator

mfcuser6-Dec-06 3:26

6-Dec-06 3:26

Thank you, I may have missed that

Re: Database Code Generator

Drew McGhie6-Dec-06 3:28

6-Dec-06 3:28

In terms of SQL code generation, check out proper databinding and the dataAdapter class. This allows you to set up a query through an adapter, and then bind a textbox to a column(and specific row if necessary) of the result. The dataAdapter will automatically do the SQL generation for loading from / saving back to the db for you. Its good stuff.

Check out here[^] for Databinding basics (its in VB, but the concepts are the same), and here[^] for a more advanced view at things (the book is great, I use it all the time as a reference).

Re: Database Code Generator

mfcuser6-Dec-06 3:49

6-Dec-06 3:49

That is good, I will look at that. I have just print out the article. Since I am new to database, I have asked this question before, but nobody answered me.

here is it and it is from this link
http://www.codeproject.com/script/comments/forums.asp?msg=1785663&forumid=1649&mode=all&userid=191012#xx1785663xx[^]
============================================
I want to know which one is better. I see a better benefit on scripting, since any change on the database will enable you to change some code. Here is what I am talking about

Assume that I arleady know the database. For instance, I want to connect to an company database to read some information about employee names. Now, I can have a sample of that database and use a wizad to do that. Or I can use the oldbconnection and use sql command to do that. What I like with the wizard, is the fact that every field from the database can be pulled up with intellisense. And very easy to connect those field or the database to windows form component.

The problem I see in the wizard, if you don't know much about that dabase in advance and whant to read some field on it. I also see more people or book use the scripting than the wizard.

Anyway, all what I want to know which one is better to use; the database wizard or the sql command string which is related to ado.

Re: Database Code Generator

Pete O'Hanlon6-Dec-06 3:44

6-Dec-06 3:44

You should never use textbox text directly inside your Sql query. See Colin's article on it
http://www.codeproject.com/cs/database/SqlInjectionAttacks.asp[^]

Arthur Dent - "That would explain it. All my life I've had this strange feeling that there's something big and sinister going on in the world."
Slartibartfast - "No. That's perfectly normal paranoia. Everybody in the universe gets that."

Deja View - the feeling that you've seen this post before.

Re: Database Code Generator

mfcuser6-Dec-06 3:47

6-Dec-06 3:47

I haven't read the article, but what I did, I passed it to another string. For example,

stringName = textBox.Txt; I don't see the difference

Re: Database Code Generator

eggsovereasy6-Dec-06 3:54

6-Dec-06 3:54

Yeah... that does nothing. You need to sanitize user input and that article will explain how.

The problem is if something like this happens...

The user enters "'); DELETE FROM TableName WHERE 0 = 0;" into your text box then the sql statement becomes:

INSERT INTO TableName(FieldName) VALUES(''); DELETE FROM TableName WHERE 0 = 0;');

That means it inserts an empty string into the column and then deletes all rows from the table.

Re: Database Code Generator

Paul Conrad6-Dec-06 4:20

6-Dec-06 4:20

mfcuser wrote:
stringName = textBox.Txt; I don't see the difference

That is still dangerous. Read Colin's article that Pete referred to Smile | :)

Smile | :)

Some people have a memory and an attention span, you should try them out one day. - Jeremy Falcon

Re: Database Code Generator

mfcuser6-Dec-06 4:51

6-Dec-06 4:51

Now, I will start to use databinding rather than getting user input directly

Re: Database Code Generator

Colin Angus Mackay6-Dec-06 5:08

Colin Angus Mackay

6-Dec-06 5:08

There is nothing wrong with getting user input directly if you sanitise it (which you will still need to do with databinding) and use parameterised queries. See the article, it explains how to go from injecting values directly into a SQL Statement to using parameterised queries.

Upcoming Scottish Developers events:
* We are starting a series of events in Glasgow in 2007. Are you interested in a particular subject, or as a speaker?
* Developer Day Scotland: are you interested in speaking or attending?

My: Website | Blog | Photos

Re: Database Code Generator

Paul Conrad6-Dec-06 5:12

6-Dec-06 5:12

mfcuser wrote:
I will start to use databinding rather than getting user input directly

It's not a matter of how you get the user input, but a matter of what the user inputs into the text box that is the security concern. Like Colin said in his post below, you still need to sanitize the input.

Some people have a memory and an attention span, you should try them out one day. - Jeremy Falcon

Re: Database Code Generator

mfcuser6-Dec-06 5:24

6-Dec-06 5:24

Assume that I use DataBindings with a textbox to update a table. I assume that I don't need to use the INSERT INTO sql statement.

Re: Database Code Generator

mfcuser6-Dec-06 5:35

6-Dec-06 5:35

I still have a problem with sanitization. Assume that the user is going to insert or update a field from a table. The user types something on the textbox. The word or phrase the user types can be anything like "word, letter, number, especial charater or a mixture". There is no way I can determine that in advance. So how can I sanitize that?

Re: Database Code Generator

Paul Conrad6-Dec-06 6:13

6-Dec-06 6:13

Use parameterized queries as stated in Colin's article and you don't have to worry about doing it, the parameterized query will do this behind the scenes for you. It may be extra coding to do the parameterized queries but it is worth it from a security stand point.

Some people have a memory and an attention span, you should try them out one day. - Jeremy Falcon

Re: Database Code Generator

mfcuser6-Dec-06 6:46

6-Dec-06 6:46

I was just thinking about that. This is what I will do before passing the data.

Re: Database Code Generator

Colin Angus Mackay6-Dec-06 7:17

Colin Angus Mackay

6-Dec-06 7:17

mfcuser wrote:
Assume that I use DataBindings with a textbox to update a table. I assume that I don't need to use the INSERT INTO sql statement.

Yes, you will. How else is it going to get into the database? All the databinding and funky wizards that Visual Studio provides hide a lot of the actual functionality. You shuould take a look at the code the wizards produce. It isn't the nicest thing to read (generated code often isn't - neither is it to be considered a good way to code either) but it will teach you a fair bit about what is going on under the hood.

Upcoming Scottish Developers events:
* We are starting a series of events in Glasgow in 2007. Are you interested in a particular subject, or as a speaker?
* Developer Day Scotland: are you interested in speaking or attending?

My: Website | Blog | Photos

Re: Database Code Generator

Paul Conrad6-Dec-06 9:18

6-Dec-06 9:18

Colin Angus Mackay wrote:
look at the code the wizards produce. It isn't the nicest thing to read

Yep, that sure is the truth Smile | :)

Smile | :)

If you try to write that in English, I might be able to understand more than a fraction of it. - Guffa

Conversion to Byte Array...

Eytukan6-Dec-06 1:43

6-Dec-06 1:43

What's the best way to convert an Object to byte array? For example I've a DataTable, I need to convert it to a Byte[]. I tried this..

<br />
			dt = ds.Tables["Orders"];<br />
			<br />
			object obj = new object();<br />
			obj = (object)dt;<br />
			<br />
		        Byte[] byteTable = (Byte[])obj;	//Error<br />

I dont get run-time error at line 4. Byte[] byteTable = (Byte[])obj; invalid Casting. Any help?

:Gong: 歡迎光臨吐西批 :Gong:

Re: Conversion to Byte Array...

Eytukan6-Dec-06 2:22

6-Dec-06 2:22

<br />
                        MemoryStream memStream1 = new MemoryStream();<br />
			BinaryFormatter formatter = new BinaryFormatter();<br />
			formatter.Serialize(memStream1, obj);<br />
			byte [] bytes = memStream1.GetBuffer();<br />
			memStream1.Close();<br />
<br />
			MemoryStream memStream2 = new MemoryStream(bytes);<br />
			object obj2 = (object)formatter.Deserialize(memStream2);<br />
			DataTable dt2 = new DataTable("Table2");<br />
			dt2= (DataTable)obj2;<br />
			Console.WriteLine(dt2.Rows.Count);<br />
	 	        Console.ReadLine();<br />

:Gong: 歡迎光臨吐西批 :Gong:

General News Suggestion Question Bug Answer Joke Praise Rant Admin

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.