Re: sql Statement Date object
- From: "Marina" <someone@xxxxxxxxxx>
- Date: Wed, 27 Jul 2005 16:17:25 -0400
No, he is saying you should use a parameterized query.
"bbdobuddy" <bbdobuddy@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:325156EA-7631-43E3-B70C-1B59ED91CB5E@xxxxxxxxxxxxxxxx
> so what your saying is that for every table column I need to update I
> should
> do them individually.
>
> "Brock Allen" wrote:
>
>> You shouldn't be concatenating your sql strings -- your code will be
>> vulnreable
>> to a sql injection attack which is a very serious security hole. Instead
>> use parameterized queries:
>>
>> SqlCommand cmd;
>> cmd.CommandText = "update authors set au_fname = @fname where au_id =
>> @ID";
>> cmd.Parameters.Add("@fname", "Brock");
>> cmd.Parameters.Add("@ID", "444-55-6666");
>>
>> and so on....
>>
>> For your datetime column, you might have better luck by passing a
>> DateTime
>> as the 2nd parameter to Add().
>>
>> -Brock
>> DevelopMentor
>> http://staff.develop.com/ballen
>>
>>
>>
>> > Hi,
>> >
>> > I have an ASP.net application with a connection to a sql database. I
>> > am writing a SQL statement to update some fields in a table but it
>> > won't run because it gives me an error that says
>> >
>> > Error near #
>> >
>> > How do I fix this problem the Code is below
>> >
>> > "UPDATE DefendantInformation SET [First Name] = '" & txtDefFName.Text
>> > & "'" _
>> > & ", [Last Name] = '" & txtDefLName.Text & "', [Address] =
>> > '" &
>> > txtDefAddress.Text & "'" _
>> > & ", [City] = '" & txtDefCity.Text & "', [DOB] = #" &
>> > txtDefDOB.Text & "#" _
>> > & "WHERE ID = " & valueSelected
>> > Regards Brian
>> >
>>
>>
>>
>>
.
- References:
- sql Statement Date object
- From: bbdobuddy
- Re: sql Statement Date object
- From: Brock Allen
- Re: sql Statement Date object
- From: bbdobuddy
- sql Statement Date object
- Prev by Date: DataGrid is there a way to make a column as wide as the longest text?
- Next by Date: Re: How do you measure the size of a page delivered to the browser (and the Viewstate)
- Previous by thread: Re: sql Statement Date object
- Next by thread: Re: sql Statement Date object
- Index(es):
Relevant Pages
|
