Solved

Update table on AS400 from vb.net app

Posted on 2007-11-14
7
1,302 Views
Last Modified: 2013-11-26
I am using the iDB2Connection.  Here is my code:
Private Sub btnUpdate1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnUpdate1.Click
        Dim cn As iDB2Connection = New iDB2Connection("User ID=me;Password=me;Data Source=10.1.1.999;Connection Timeout = 0")
        Dim cmd As iDB2Command
        Dim sqlstring As String
                     
        sqlstring = "insert into libery.table (saacct, sanam1, sanam2, saadd1, sacity) values (" & txtName.Text & ", " & txtAddress.Text & ", " & txtCity.Text & ", " & txtState.Text & ", " & txtZip.Text & ")"

        Dim da As New iDB2DataAdapter(sqlstring, cn)
        'Dim ds As New DataSet("Airbill")

        'Open connection
        cn.Open()
        cmd = New iDB2Command(sqlstring, cn)
        cmd.ExecuteNonQuery()

        cn.Close()

    End Sub

Now when I run this and put in numeric data, it works fine, when I put in alphanumeric I get this error:
SQL0206 Column (whatever letter I put in the txtaddress.text) not in specified tables, but like I said numbers work fine.  Why would it see the text in my textbox as the column name?  The type in the fields of the table on the AS400 are set to Alpha except for the first textbox.  Thanks

0
Comment
Question by:bergertime
  • 3
  • 3
7 Comments
 
LVL 18

Expert Comment

by:daveslash
ID: 20281984

You probably need to enclose your text in single quotes.

At the point of exceuting the query, what (exactly) is the value of sqlstring? (the working one AND the non-working one)

- DaveSlash
0
 
LVL 3

Expert Comment

by:WaldenL
ID: 20282000
>Why would it see the text in my textbox as the column name?
Because you aren't quoting the data. Play it out as if you were the program, given your sql string, you'd end up with:

insert into libery.table (saacct, sanam1, sanam2, saadd1, sacity) values (122, Main st, Anytown, NY, 11111)

When what you want is:

insert into libery.table (saacct, sanam1, sanam2, saadd1, sacity) values (122, 'Main st', 'Anytown', 'NY', '11111')

HOWEVER, be very careful. In the example you've provided you're wide open to a SQL injection attack. Ask yourself this question, what happens if I, the user, put this into the txtAddress box:

';delete * from table;'

You'll string that right into the test and end up with a sql statement that drops a table. You should be using parameters for this operation.
0
 
LVL 2

Author Comment

by:bergertime
ID: 20282059
'You should be using parameters for this operation.'

How would I do that in the above example?
0
DevOps Toolchain Recommendations

Read this Gartner Research Note and discover how your IT organization can automate and optimize DevOps processes using a toolchain architecture.

 
LVL 3

Expert Comment

by:WaldenL
ID: 20282111
Something to the effect of:

Private Sub btnUpdate1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnUpdate1.Click
      Dim cn As iDB2Connection = New iDB2Connection("User ID=me;Password=me;Data Source=10.1.1.999;Connection Timeout = 0")
      Dim cmd As iDB2Command
      Dim sqlstring As String
                     
      sqlstring = "insert into libery.table (saacct, sanam1, sanam2, saadd1, sacity) values (@Acct, @Nam1, @Nam2, @Add1, @City)"

      'Open connection
      cn.Open()
      cmd = cn.CreateCommand()
      cmd.CommandText = sql
      cmd.Prepare()

      cmd.Parameters("@Acct").Value =  txtName.Text
      cmd.Parameters("@Nam1").Value =  txtAddress.Text
      cmd.Parameters("@Nam2").Value = txtCity.Text
      '... set rest of parms

      cmd.ExecuteNonQuery()

      cn.Close()

End Sub

No probmises on the VB syntax, but it's close enough.

And before someone points out that the prepare() is a waste of a trip to the DB, IBM will do the prepare if you haven't, so you might as well take advantage of it.
0
 
LVL 2

Author Comment

by:bergertime
ID: 20282198
Thanks so much, you have answered my question, but if I might get two points a little more clear,  how does the parameters prevent the SQL injection attack?  And I'm not sure what you meant by 'the prepare() is a waste of a trip to the DB'....I didn't have it in my code, should I have it?
0
 
LVL 3

Accepted Solution

by:
WaldenL earned 500 total points
ID: 20282242
By using parameters the 400 knows that each of the values are _values_ and not part of the string, therefore if you have a ;drop... in the value it will simply be interted into the row as text, also solves the problem of having to double single quotes in names like O'Conner.

As for prepare, it was in my example. It tells the ADO.Net to go ask the server to prepare the statement (sql-speak), and to determine the parameters and types in the sql statement passed. I used it so the Parameters collection would be populated.

To do the "prepare" there's a round-trip to the server. On other DBMSs, if you don't call prepare you'll avoid that round-trip, but in the case of the IBM provider, they do the round-trip no matter what, so you might as well use it to populate the parameters collection.

-Walden
0
 
LVL 2

Author Comment

by:bergertime
ID: 20282271
Thank you so much, I'm not sure if I've ever had an answer that was this clear.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

More often than not, we developers are confronted with a need: a need to make some kind of magic happen via code. Whether it is for a client, for the boss, or for our own personal projects, the need must be satisfied. Most of the time, the Framework…
Real-time is more about the business, not the technology. In day-to-day life, to make real-time decisions like buying or investing, business needs the latest information(e.g. Gold Rate/Stock Rate). Unlike traditional days, you need not wait for a fe…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now