Re: Execute the insert command with boolean

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Davide Vernole [MVP] (davide_at_online.knodev.com)
Date: 10/12/04 

Date: Wed, 13 Oct 2004 01:50:54 +0200

Ken Cox [Microsoft MVP] <BANSPAMken_cox@sympatico.ca> typed:
> It looks like the Boolean field is being inserted as a string. You
> may need to drop the apostrophe on either side and use something like
>
> contentavailable.Checked.ToString
>

Just to remember you that it's better to don't use this kind of SQL
Statement in your code. Your application risk SQL Injection attacks (see
this useful article:
http://msdn.microsoft.com/msdnmag/issues/04/09/SQLInjection/)

Don't forget to review your code to avoid SQL Injection ;-) 

-- 
Davide Vernole
MVP ASP/ASP.NET
Microsoft Certified Solution Developer

Relevant Pages

  • [REVS] Advanced Topics on SQL Injection Protection
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SQL injection is now one of the most common attacks in the Internet. ... Static query statement - Development Phrase ... Some programmers may think escaping apostrophe with two apostrophes (and ...
    (Securiteam)
  • Re: Form login
    ... Aren't you only leaving yourself open for sql injection if you don't ... make sure that certain characters aren't in the string before you ... allow them into your sql string. ... This email account is my spam trap so I ...
    (microsoft.public.inetserver.asp.db)
  • Re: Regular Expression help C#
    ... I have a method that basically parses any string sent to it to ensure ... I have my pattern started, but I cannot seem to figure how to only ... you should never have to worry about SQL injection. ... the problem is, that there are more keywords that you could ever take into account, especially if you take database independency into account. ...
    (microsoft.public.dotnet.general)
  • Re: Another form of SQL injection
    ... It allows query parameters to be binded and ... $name = "tom' UNION blah blah blah" ... another form of SQL injection might in the form of... ... is as a string ... ...
    (comp.lang.php)
  • Re: Speeding up in-line queries
    ... Astra wrote: ... difference in a loop that's building a huge string. ... The real problem is the possibility of SQL Injection: ... This email account is my spam trap so I ...
    (microsoft.public.inetserver.asp.db)