.net - Prevent SQL Injection In Dynamic Column Names?
Jun 8, 2012
My question is how best to avoid SQL Injection with the method I am currently using.EDIT (Reasoning): There are many of columns in a number of tables (a number which grows (only) and is maintained elsewhere). I need a method of allowing the user to decide which (predefined) column they want to query (and if necessary apply string functions to). The query itself is far too complex for the user to write themselves, nor do they have access to the db. There are 1000's of users with varying requirements and I need to remain as flexible as possible - I shouldn't have to revisit the code unless the main query needs to change - Also, there is no way of knowing what conditions the user will need to use
I've been contracted to analyze an existing Data Provider and I know the following code is faulty; but in order to point out how bad it is, I need to prove that it's susceptible to SQL injection.
Question What "Key" parameter could break the PrepareString function and allow me to execute a DROP statement?
I have a DataGridView which populates from an SQL query just fine in default mode
using these table names [firstName] [varchar](20) NOT NULL, [lastName] [varchar](20) NOT NULL,
[code]....
I have edited the column headers and set the column names to the same values as my table names yet the data is not showing in form load I have set datagridview.AutoGenerateColumns = False I know the data is there if I delete datagridview.AutoGenerateColumns = False then the data is shown with the default headings?
I have a directory 'C:Test' with three files in it:
A23456789.txt A1.txt G 5.txt
And I run this command:
Dim FileArr = Directory.GetFiles("C:Test", "*1.txt", SearchOption.AllDirectories)
All three files are returned.I understand that this is by design and .NET searches the 8.3 short file names as well.But is there any way to override this and search the actual file names only?Surely, in this day and age there must be a function to do this. Or do I have to write my own?I would like the search function to have the same behavior as the Windows Explorer for consistency.
Each time it runs, a program of mine creates an Excel document and names it using the current date ("Alerts from 29062011.xlsx" for example). The program gets run once a day,every day.The users have requested that I have the program delete the previous days Excel file each time it runs so that they don't take up space. I'm unsure how to do this though since, for example, if it is run on the first day of the month it would have to know
im trying to create smarter more efficient code in my project by having all lables change to their desired states by use of a for loop. currently my labels are all something like lblB1. can i do anthing like the following?
I'm looking to create multiple variables based on a counter object. For example if a counter object is 6 I want to create 6 instances of the variable mText
Something like: Dim i as integer Dim Count as integer = 6
I need to iterate through controls using dynamic construction of control names and it looks like this could be what I need, however I never used this before and it does not quite work. What am I doing wrong? GroupBox1 is what I am attempting
Dim x as Integer = 1 For Each ctrl As Control In CallByName(Me, "GroupBox" & CStr(x), CallType.Method).Controls The runtime error is "GroupBox1" not found on Form1 even though I can select Me.GroupBox1 from the dropdown list.
Is there a way to use Meta Tales or Table names to Construct a dynamic query in LINQ?
foreach (var metaTable in db.Mapping.GetTables()) { var queryType = metaTable.RowType.Type;
[code]....
Is there a way to do something like this? The attempt above yields the error:Could not find an implementation of the query pattern for source type 'System.Data.Linq.ITable'. 'Select' not found. Consider explicitly specifying the type of the range variable 'q'.
i want prevent user order column.i have a datagridview , it has allowuserordercolumns properties and it is set to false. But i didnt see so. i still order column.how can i prevent user ordering column.
i recently posted a code that i had that i needed assistance for and it was solved it was for displaying all tables in a database.but now i have this code for showing all column names in a table i was in the process of turning it from oledb to sqlclient. GetOLedbSchema can be turned to getschema but when it comes to OleDbSchemaGuid
Public Shared Function getAllColumnNames(ByVal tblname As String) As String() Dim com As New SqlCommand Dim con As SqlConnection
i have this code for showing all column names in a table i was in the process of turning it from oledb to sqlclient. GetOLedbSchema can be turned to getschema but when it comes to OleDbSchemaGuid
Public Shared Function getAllColumnNames(ByVal tblname As String) As String() Dim com As New SqlCommand Dim con As SqlConnection
The name "Debit" is not permitted in this context. Valid expressions are constants, constant expressions, and (in some contexts) variables. Column names are not permitted.
I need to limit the amount of columns being returned from a datatable from 14 to 5 or 6. Date, Hour and 3 to 4 decimal columns. Is it possible to do something like a SQL 'Like' to specify which columns I want?
So i create a datatable from a table i can't directly view(i.e. using sql server management). I want to find the column names that are in the datatable, what would be the correct way do this?
I have the following code to get the column names from my Microsoft Access database.THE PROBLEM is that the stupid thing orders it alphabetically for me. How do I get it to put the columns in order the way they are in the database?[code]I've also tried a different approach with a string array and for loop to "make it" go to the beginning, but proves my point that its stupid enough to order it for me.
I have to create a report that lists tests that a student has taken and how they answered each question...the column header layout (roughly) looks like:
Test #1 1 2 3 4 5 Test #2 1 2 3 4 5 TestA A B C D E TestB C C B C E
The problem is that the Gridview doesn't seem to like repetitive column names and is renaming the second set of Question #s to something else.
I have a table in a Access Database that I'm loading into a VB.NET program and I want a way to get the name of each of the columns into a list of Strings. Googling has shown that this is much easier with a SQL database, but that doing so in Access is much more difficult. I came across this question Is there a query that will return all of the column names in a Microsoft Access table? Which gives a way to do it, but when I try the code it just populates my list with a bunch of "System.Collections.Generic.List'1[System.String]"
This is my adapted code. Public Function GetColumns(ByRef database As String, ByRef table_name As String, ByRef columns As List(Of String)) As Integer Dim com As OleDbConnection Try com = New OleDbConnection(database) com.Open() [Code] ..... My for each loop isn't printing the right string. Should be Console.WriteLine(holding)
I have A database in access2007 I want retrieve column names with sql query in my project I write below code: "select column_name from information_schema.columns where table_name ='table 1' ORDER BY ORDINAL_POSITION" but display error : Could not find file 'D:ProjectsTapco_ECMTapco_ECMTapco_ECMinDebuginformation_schema.mdb'.
I am struggling to show different views of gridview with database values. Here is my requirement. Database Table:I need to show one drop downlist with three values 1,2,3. If user selects 3 i Need to show a grid like belowAge,AnnualSales and Assortment are names which are coming dynamically from database.
I'm just a frustrated noob trying to get past my first DB Program. My goal is to get relational data from different tables all ordered by a certain field..Ive noticed early on that i cannot select a column when its name has a space.[code]Now the statement i want to use is sql = "SELECT [PT.Chart Number],[PT.Last Name],[CA.Case Number] FROM Table1 AS PT INNER JOIN Table2 AS CA ON PT.Chart Number = CA.Chart Number ORDER BY PT.Chart Number"..When i Debug i get the same type of error ("... Can't find column name PT.Chart... ")I'm new to sql so i dont know if my syntax is off.
How do i edit the column header of the GridView control on a web form? I have added a Table to DataSource as:
Me.gvSearchBrandList.DataSource = ds.Tables(0)
in here "gvSearchBrandList" GridView control But the GridView control display the column headers of the Table in the database. But how do i edit those column name in the GridView?
I have a csv file and I import it to datagridview. Now I filter it using 2 datetimepickers. One for start and other for end.When click it must loop through the column names and must display only the columns which matches start date, range of columns between start and end date,enddate. please see the image attached.First image shows the datagridview when loaded from csv.second shows the desired output when filtered using datetimepickers.
I have mysql database with one table , and I want to show the columns' names re;taed to the table in combobox in vb 2005
this is my mysql command :
SQL1 = " select column_name from information_schema.columns where table_name='others'; "
this is my code after execute the command and store the data set in variable ( DS ) which its type is "DataSet " :
If DS.Tables(0).Columns.Count > 0 Then For j As Integer = 0 To DS.Tables(0).Rows.Count - 1 list1.Items.Add(DS.Tables(0).Rows(0).ToString) Next (j) End If
It is not so hard to get the field names from a database via GetOleDbSchemaTable and OleDbSchemaGuid.Columns. It works fine. The field names come i alphabetical order though. I really need them in the correct field no order.
Used code:
connection.Open() Dim schemaTable As DataTable = _ connection.GetOleDbSchemaTable(OleDbSchemaGuid.Columns, New Object() {Nothing, Nothing, tblname, Nothing})
