Click here to Skip to main content
15,880,651 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
try
           {
               DataRowView dataRowView = (DataRowView)((CheckBox)e.Source).DataContext;
               String ProductName = dataRowView[1].ToString();
               String ProductDescription = dataRowView[2].ToString();
               Assignid = dataRowView[0].ToString();
               menu_id = dataRowView[1].ToString();
               mod_id = dataRowView[2].ToString();
               name = dataRowView[3].ToString();
               if ((sender as CheckBox).IsChecked == true)
               {
                   Assign = "True";
                   DataSet load_am = Globalvariables.Globals.select("Select * from modifier_assign where ma_id = '"+ Assignid +"' and modifier_id = '" + mod_id + "' and menu_id = '"+ menu_id + "'");
                   if (load_am.Tables[0].Rows.Count > 0)
                   {
                       con.Open();
                       SqlCommand cmd = new SqlCommand("load_ma", con);
                       cmd.CommandType = CommandType.StoredProcedure;
                       cmd.Parameters.AddWithValue("@ma_id", SqlDbType.Int).Value = string.IsNullOrWhiteSpace(Assignid) ? DBNull.Value : (object)Assignid;
                       cmd.Parameters.AddWithValue("@modifier_id", SqlDbType.Int).Value = string.IsNullOrWhiteSpace(mod_id) ? DBNull.Value : (object)mod_id;
                       cmd.Parameters.AddWithValue("@menu_id", SqlDbType.Int).Value = string.IsNullOrWhiteSpace(menu_id) ? DBNull.Value : (object)menu_id;
                       cmd.Parameters.AddWithValue("@modifiername", SqlDbType.Int).Value = string.IsNullOrWhiteSpace(name) ? DBNull.Value : (object)name;
                       cmd.Parameters.AddWithValue("@assign", SqlDbType.Int).Value = string.IsNullOrWhiteSpace(Assign) ? DBNull.Value : (object)Assign;
                       cmd.ExecuteNonQuery();
                       con.Close();
                   }
                   else
                   {
                       con.Open();
                       SqlCommand cmd = new SqlCommand("Insert into modifier_assign(modifier_id,menu_id,modifiername,assign) values('" + mod_id + "','" + menu_id + "','" + name + "','" + Assign + "')", con);
                       cmd.ExecuteNonQuery();
                       con.Close();
                   }
               }
               else
               {
                   Assign = "False";
                   con.Open();
                   SqlCommand cmd = new SqlCommand("load_ma", con);
                   cmd.CommandType = CommandType.StoredProcedure;
                   cmd.Parameters.AddWithValue("@ma_id", SqlDbType.Int).Value = string.IsNullOrWhiteSpace(Assignid) ? DBNull.Value : (object)Assignid;
                   cmd.Parameters.AddWithValue("@modifier_id", SqlDbType.Int).Value = string.IsNullOrWhiteSpace(mod_id) ? DBNull.Value : (object)mod_id;
                   cmd.Parameters.AddWithValue("@menu_id", SqlDbType.Int).Value = string.IsNullOrWhiteSpace(menu_id) ? DBNull.Value : (object)menu_id;
                   cmd.Parameters.AddWithValue("@modifiername", SqlDbType.Int).Value = string.IsNullOrWhiteSpace(name) ? DBNull.Value : (object)name;
                   cmd.Parameters.AddWithValue("@assign", SqlDbType.Int).Value = string.IsNullOrWhiteSpace(Assign) ? DBNull.Value : (object)Assign;
                   cmd.ExecuteNonQuery();
                   con.Close();
                               }

           }
           catch (Exception ex)
           {
               MessageBox.Show(ex.Message);
           }


What I have tried:

private void binddatagrid()
        {
            value = New_AFM.id;
            edit_val = New_AFM.edit;
            if (edit_val == 1)
            {
                
                DataSet load_am = Globalvariables.Globals.select("Select ma.ma_id,afm.menu_id,am.modifier_id as modifier_id,am.modifiername as modifiername from add_modifier am, add_food_menu afm,modifier_assign ma where afm.menu_id =  '" + value + "'");
                if (load_am != null && load_am.Tables[0].Rows.Count > 0)
                {
                    dataGrid.ItemsSource = load_am.Tables[0].DefaultView;
                    con.Close();
                }
            }
Posted
Comments
Richard Deeming 10-Nov-22 7:25am    
Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation/interpolation to build a SQL query. ALWAYS use a parameterized query.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900