Solved

C#: SQL string with textBox user input?

Posted on 2004-09-17
5
220 Views
Last Modified: 2010-04-15
I'm attempting to substitute a testBox variable in place of the usual tableName in an SQL string.

Q. Is the following code correct?


string SQL1 = " INSERT INTO  ' " + txtSqlTable.Text.ToString() + " ' (col_Port, col_Desc)  VALUES" +
           " ( ' " + Port.ToString() + " ' , ' " + Desc.ToString() + " ' )";
SqlConnection cn1 = new SqlConnection("integrated security=SSPI;data source=office; persist security info=False;initial catalog=master");
SqlDataAdapter da1 = new SqlDataAdapter(SQL1,cn1);
cn1.Open();
da1.SelectCommand.ExecuteNonQuery();            
cn1.Close();
0
Comment
Question by:kvnsdr
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 
LVL 20

Expert Comment

by:ihenry
ID: 12087653
are you inserting record to a table in master database?
0
 
LVL 1

Author Comment

by:kvnsdr
ID: 12088520
yes
0
 
LVL 5

Accepted Solution

by:
tomasX2 earned 125 total points
ID: 12088966
REMOVE THE '

string SQL1 = " INSERT INTO  ' " + txtSqlTable.Text.ToString() + " ' (col_Port, col_Desc)  VALUES" +
          " ( ' " + Port.ToString() + " ' , ' " + Desc.ToString() + " ' )";

becomes

string SQL1 = " INSERT INTO  " + txtSqlTable.Text.ToString() + " (col_Port, col_Desc)  VALUES" +
          " ( ' " + Port.ToString() + " ' , ' " + Desc.ToString() + " ' )";

sounds dangerous though... hope it´s not a action an anonymous user could do.
0
 
LVL 5

Expert Comment

by:tomasX2
ID: 12088971
I mean because you use string parsing and not parameters.
0
 
LVL 10

Expert Comment

by:ptmcomp
ID: 12091163
If it's a tool for yourself it's ok. If you roll this out to a wider usergroup then people could do almost everything with your database by entering malicious  code in the textboxes. Google for "SQL injection" to get more information about it.
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article introduced a TextBox that supports transparent background.   Introduction TextBox is the most widely used control component in GUI design. Most GUI controls do not support transparent background and more or less do not have the…
This article is for Object-Oriented Programming (OOP) beginners. An Interface contains declarations of events, indexers, methods and/or properties. Any class which implements the Interface should provide the concrete implementation for each Inter…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question