?
Solved

c# using a TableAdaptor in a WebService

Posted on 2009-05-04
7
Medium Priority
?
265 Views
Last Modified: 2013-11-26
I'm trying to switch over to using a TableAdaptor instead of having the SQL directly in my cs page as I read somewhere this is bad practice due to SQL injection.

So i've added a Dataset to my project and added a TableAdaptor to it, but now in my code i'm trying to access this with no joy.
I've looked here
http://msdn.microsoft.com/en-us/library/ms233822(VS.80).aspx 

and tryed using the Intellisense to bring up my TableAdaptor but it's nowhere to be seen.

Could you give me some examples on what I should be doing here?
Many Thanks.
0
Comment
Question by:andrewmilner
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
7 Comments
 
LVL 4

Assisted Solution

by:cauos
cauos earned 400 total points
ID: 24298393
at the end of the page in the link you posted there is a title "How to: Create TableAdapters" check that link to know how to create TableAdapters
this is the link
http://msdn.microsoft.com/en-us/library/6sb6kb28(VS.80).aspx
0
 
LVL 12

Expert Comment

by:wht1986
ID: 24298474
you can still use 'inline' sql, just make sure you use parameters, and not appending to the command string

Bad inline:
SqlCommand cmd = new SqlCommand("Select * from TesTable where TestId = " + this.TextBox1.Text, conn);

Good:

SqlCommand cmd = new SqlCommand("Select * from TesTable where TestId = @TestID", conn);
cmd.Parameters.AddWithValue("@TestID", int.Parse(this.TextBox1.Text));

the use of parameters will prevent sql injection.
0
 
LVL 1

Expert Comment

by:chuckdsc
ID: 24298776
andrewmilner,

There is a known bug in sending data from a web service,
check the MSDN blog where information is posted related to passing data from a web/wcf service

http://blogs.msdn.com/lifenglu/archive/2007/08/01/passing-datatable-across-web-wcf-services.aspx
0
Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

 

Author Comment

by:andrewmilner
ID: 24299265
How does the Parameters prevent SQL injection?

If I have
string StringFromAtextBox = TextBox1.Value

And I pass this as a parameter into an sql query then surely you can still enter sql in there?
0
 

Author Comment

by:andrewmilner
ID: 24299272
Whats the int.Parse doing in the example above?
0
 
LVL 12

Accepted Solution

by:
wht1986 earned 1600 total points
ID: 24299464
converts the string to an integer, in my example i was just showing how my select statement was expecting an integer as a parameter. so i used the int.Parse method to do the conversion and assign it with the AddWithValue method. I did it this way to avoid specifying explicitly the parameter was an integer.

you can also specify the type explicitly by
            cmd.Parameters.Add("@TestID", SqlDbType.Int);
            cmd.Parameters["@TestID"].Value = int.Parse(this.textBox1.Text);
0
 

Author Comment

by:andrewmilner
ID: 24299651
Okay well using the parameters has gotton around the issue I had.
Many thanks for your help.
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Entity Framework is a powerful tool to help you interact with the DataBase but still doesn't help much when we have a Stored Procedure that returns more than one resultset. The solution takes some of out-of-the-box thinking; read on!
Calculating holidays and working days is a function that is often needed yet it is not one found within the Framework. This article presents one approach to building a working-day calculator for use in .NET.
Add bar graphs to Access queries using Unicode block characters. Graphs appear on every record in the color you want. Give life to numbers. Hopes this gives you ideas on visualizing your data in new ways ~ Create a calculated field in a query: …
How to fix incompatible JVM issue while installing Eclipse While installing Eclipse in windows, got one error like above and unable to proceed with the installation. This video describes how to successfully install Eclipse. How to solve incompa…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question