How To Filter Out Some Vulnerability Causing Characters In Query String
Apr 7, 2009
I need to filter out characters like /?-^%{}[];$=*`#|&@'"<>()+,. I need replace this with empty string if it is there in the query string. I am using this in ASP pages.
But the result of this is that the textbox txtTags will only contain C and doesnt have the ++. I tried [URL]and the # is missing as well. But if I look at the address bar these values are there....
I am not sending any sensitive or security information in the query string. I am currently using Base64Encoding along with MD5 Hash. I want to shorten my url as far as possible.
I'm currently testing an application that I've just finished developing and i seem to have a memory leak problem that i can't figure out. If i left open Windows Task Manager i can see that the process WMIService.exe is constantly taking more and more memory. Starting from 40 000K, it was at 590 000K after 5 days.I was able to figure out which part of the application is causing me problem. So i've made a smaller application to figure out the problem but i just can't find the problem. Here is the code:
Private Sub WmiStartToolStripMenuItem_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles WmiStartToolStripMenuItem.Click<br/> LaunchWMI()<br/> End Sub<br/>
I am trying to write a query on an .aspx webpage connected to an .aspx.vb file to access some parts information on my mysql server. Everything works fine except for one poorly named file, which keeps breaking the query. The fields name (with the table name in front) is invf12.PRICEE(1STU_M) Those brackets seem to be the problem. I have tried putting single quotes around them, as in invf12.' PRICEE(1STU_M)',
I can't do anything about the fieldname. The query in total looks like this: Protected Sub LookupPart_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles LookupPart.Click Dim strSQL As String = "SELECT invf12.ITEMCODE as Part, invf02.DESCRIPTION as Description, " + _ "SUM(invf12.QUANTITYONHAND - invf12.QUANTITYRESERVED) as Available, invf12.PRICEE(1STU_M) as Price" + vbCrLf + _ "FROM invf12, invf02" + vbCrLf + _ [Code] .....
I have the following query that executes when my form loads. It's the rowsource for my combo box. The query is fine and populates the combo perfect, however, when i click into the combo box I cannot click out of it or even close the form. I have tried taking out the line of code that fills the form via table adapter on load and it works fine (opening the form unbound by the main table). Has anyone run into this before? I have another combo box on the form setup the exact same way and this is not happening. I've experimented with different datatypes etc....
code to populate combo box:
Public Shared Function LoadCallSource() As String Dim sConnectionString As String = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:Documents and Settingsdiw07My DocumentsDaily Backupsphone memo backend.mdb"
I have a string of characters, but I would like to have a string of hexdecimal characters where the hexadecimal characters are converted by turning the original characters into integers and then those integers into hexadecimal characters. How do I do that?
I have a database that I would like to filter characters from anywhere in the field. Example the letter A is typed into textbox1 and in the grid every field that contains an A is show. Like dash, lap, trap, apple. Currently with the query I'm using it will just go from the beginning of the field. I get "Index was outside the bounds of the array". The code is as followed:
Dim filter1() As String filter1 = TextBox2.Text.Split(" ") Sheet1BindingSource.Filter = "Stationary_location like '" & filter1(0) & "' Stationary_location like '" & filter1(1) & "'" VB 2008 using access database.
Not sure if too many people know this, but the following line will cause an error:
GroupName.Substring(0, 3) = "jt_"
....if the length of GroupName is less than 3 characters. I always thought it would simply return whatever characters in GroupName, but no, it errors. I must be thinking of the old VB6 days.So, I now have to change the code to:
If (GroupName.Length > 2) Then If (GroupName.Substring(0, 3) = "jt_") Then
Note that the two comparisons need to be on separate lines. If they are on the same line, such as:
If (GroupName.Length > 2) and (GroupName.Substring(0, 3) = "jt_") Then then the code will still fail as the length command is executed at the same time as the substring command- which will cause the error when the GroupName length is less than 3.Just thought that those of us not aware of this should be!
Im coming from a background of writing vba in excel, but have go to the point where im fed up of having everything running in excel and have started leaning vb.net. i am trying to do something i have done before, but am pretty much rewriting it as having got the end i now see a better way of doing things
Normally Google is full of help full answers but today it isn't, i may be i'm doing something odd or am trying to use completely the wrong tool for the job am happy to be told either.
I am trying to take data from a text file dumped from one of our databases, i have read the (huge) and oddly formatted text file in, converted it to a 1d array = InPutArray
Basically what happens is each time it loops through it adds a number to the end of the string, and by the end I should end up with an array full of string in a format like "111 222 333 444 555 666" but I end up getting strings like this "111 111 222 222 333 333". The weird thing is, if I add a message box in every loop it works fine, but obviously I don't want a message box pooping up every time it loops through. What is causing this and how might I fix it
The code is: For x As Integer = 0 To (NumCards.Value - 1) NumRep = 0
I used the data wizard to create a binding source, and table adapter, etc. I have a form and I have the fields on the form. All is good. The data is loaded via the .FILL method using the DEFAULT FILL,GetData() funtion created by the wizard. All is good. Now I want to filter out some of the records so I created a new FILL method (using the data source editor).
It is called FillByCountry() and the SQL statement looks like this "Select * from StampCollection WHERE Country = "Canada". Simple enough and when I test the query, I get what I expect. Now - suppose on the form I have a button and I when the user presses the button, the filter is enabled. So when the form loads, I have the standard lines to load the data... StampCollectionTableAdapter.Fill(SCDBDataDataSet.StampCollection)
I'm trying to access the SQL DB I have designed within my project in Visual Basic 2010 (.NET code seems to work for me 99% of the time) at runtime so that a user can select a method by which to filter a DataGridView.I have a fantasy football draft application that fills the DGV from a Table Adapter. The database is named NFLPlayerDataBase.mdf, the dataset used to fill the DGV is TabNFLPlayers11BindingSource1, the table adapter is TabNFLPlayers11Table Adapter1. The DGV is dgvDraft. Idk if that helps at all.If the user wants to look at only RBs while making their draft choice, I want them to be able to select RB from a drop-down and have the DGV be filled with the query that selects only RBs from the table. I have the drop-down already set and am able to fill in the DGV when the form initializes. I just can't get it to fill with the query request for a specified position.The table I'm looking to use from the .mdf is tabNFLPlayers11 and the column header that will be searched through the filter is "Position." Options are QB/RB/WR/TE/K/DST and will be selected by the user from a drop-down.I cannot find a way to even open the connection whenever I change the value of the drop-down.
I've been trying to figure out how to use the CONTAINS clause for the last couple of days, on and off. The appropriate datatable is configured for full-text search, but whenever I run the program and come to the point where this query is run, I get this error "Syntax error: Missing operand after 'CONTAINS' operator.". Here is the code:[code]....
I've tried replacing the "*" with parenthesis, percentages, and deleting them, but it always gets the same result. What is the correct syntax to use the CONTAINS clause within the .filter query or is there some work around or something that I am missing?
I've been trying to add a database to my interface, and i can't seem to filter the data, i want to search based on last name and only display people with the that last name (the last name will be entered in a search form).I've tried writing SQL Queries but I can't seem to pass the variable that that holds the last name into the SQL Query, to filter the data.
I've got a datacontext and created a binding source using LINQ to sql but cannot filter said bindingsource. The supportsfilter of the bindingsource is set to false ? why ? I can't find any info to say that I cannot filter a binding source based on a linq query.[code]
I create a dataset and configure the query builder and in the filter i key in this "?" and when I search the name by enter the full name it will show but what I want is just type "A" and it will show the whole name starting with A. I stuck in this problem what the code to do in order to type just 1 letter and show the whole name starting with first letter that I want.
have a query in SQL, returns the results I expect, however when I copied this query to a bindingsource.filter call,I get "Missing Operand" errors
Me.ItemsBindingSource.Filter = String.Format("SELECT * FROM items WHERE (GETDATE()) BETWEEN (items.ItemStartDate) AND DATEADD([month], items.ItemOccurances, items.ItemStartDate)")
I have a Query to Display values in grid view, now i wanted impose certain condition in query to filter the values.I have FABDue(date column) and FABComp(date column)columns in a table.I need to check following two conditions in query
1.Records which does not contain FABdue date in FABDue column, then those records should not be listed in Grid view.
2.Rcords which are having FabComp(column) date then those records should not be listed in grid view
Could not find this through Google or in SO questions.I have a checkbox listbox on my form. I want to filter my List by the list of selected Ids from that listbox that are checked, in SQL I would have done this like "Where TypeId In (1, 4, 5, 7)"... how do I do that in LINQ?
I feel like I am missing a really obvious answer, but cannot get it.
For argument sake... here is the what I have for sample data:
I'm develloping a small application over na Access 2007 database. how can i pass the value of a combobox to a query being built with the query builder tool?If I use ? in the Filter column I�m prompted to enter the value but what I need is to pass the value of a combobox in a form. I tried to use:
HTML =MyForm.MycomboBox.Value
but it is ignored, interpreted as the value to be filtered.
The data was being read from a Gridview which had the html encoding. The solution was the following...
Dim Sht_Text As String = HttpUtility.HtmlDecode(row.Cells.Item(0).Text)
I am trying to prevent from having to escape apostrophes and other special characters in my string variables by using a parameterized query with an OleDbConnection. I have all of the parameters in the same order, the insert is working, it just does not maintain the characters. I keep getting those pesky html codes. I am trying to insert into an Access db from a web pages. As I mentioned, its working, just not the special characters.
Here's the code:
Dim pConn As New OleDb.OleDbConnection pConn = New OleDbConnection(cb.ConnectionString) Dim SqlString As String = "INSERT INTO Strings (Mlt_String_ID, Lng_ID, Strg_Name, Sht_Text, Lng_Text, Alt_Text) Values (?, ?, ?, ?, ?, ?)"
[code]....
jp and en records already existed, the insert of fr record pushes the html codes for the small circle which represents the degree symbol. Happens for all other special characters as well.