Solved

c# using a TableAdaptor in a WebService

Posted on 2009-05-04
7
259 Views
Last Modified: 2013-11-26
I'm trying to switch over to using a TableAdaptor instead of having the SQL directly in my cs page as I read somewhere this is bad practice due to SQL injection.

So i've added a Dataset to my project and added a TableAdaptor to it, but now in my code i'm trying to access this with no joy.
I've looked here
http://msdn.microsoft.com/en-us/library/ms233822(VS.80).aspx

and tryed using the Intellisense to bring up my TableAdaptor but it's nowhere to be seen.

Could you give me some examples on what I should be doing here?
Many Thanks.
0
Comment
Question by:andrewmilner
7 Comments
 
LVL 4

Assisted Solution

by:cauos
cauos earned 100 total points
ID: 24298393
at the end of the page in the link you posted there is a title "How to: Create TableAdapters" check that link to know how to create TableAdapters
this is the link
http://msdn.microsoft.com/en-us/library/6sb6kb28(VS.80).aspx
0
 
LVL 12

Expert Comment

by:wht1986
ID: 24298474
you can still use 'inline' sql, just make sure you use parameters, and not appending to the command string

Bad inline:
SqlCommand cmd = new SqlCommand("Select * from TesTable where TestId = " + this.TextBox1.Text, conn);

Good:

SqlCommand cmd = new SqlCommand("Select * from TesTable where TestId = @TestID", conn);
cmd.Parameters.AddWithValue("@TestID", int.Parse(this.TextBox1.Text));

the use of parameters will prevent sql injection.
0
 
LVL 1

Expert Comment

by:chuckdsc
ID: 24298776
andrewmilner,

There is a known bug in sending data from a web service,
check the MSDN blog where information is posted related to passing data from a web/wcf service

http://blogs.msdn.com/lifenglu/archive/2007/08/01/passing-datatable-across-web-wcf-services.aspx
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 

Author Comment

by:andrewmilner
ID: 24299265
How does the Parameters prevent SQL injection?

If I have
string StringFromAtextBox = TextBox1.Value

And I pass this as a parameter into an sql query then surely you can still enter sql in there?
0
 

Author Comment

by:andrewmilner
ID: 24299272
Whats the int.Parse doing in the example above?
0
 
LVL 12

Accepted Solution

by:
wht1986 earned 400 total points
ID: 24299464
converts the string to an integer, in my example i was just showing how my select statement was expecting an integer as a parameter. so i used the int.Parse method to do the conversion and assign it with the AddWithValue method. I did it this way to avoid specifying explicitly the parameter was an integer.

you can also specify the type explicitly by
            cmd.Parameters.Add("@TestID", SqlDbType.Int);
            cmd.Parameters["@TestID"].Value = int.Parse(this.textBox1.Text);
0
 

Author Comment

by:andrewmilner
ID: 24299651
Okay well using the parameters has gotton around the issue I had.
Many thanks for your help.
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Problem Hi all,    While many today have fast Internet connection, there are many still who do not, or are connecting through devices with a slower connect, so light web pages and fast load times are still popular.    If your ASP.NET page …
International Data Corporation (IDC) prognosticates that before the current the year gets over disbursing on IT framework products to be sent in cloud environs will be $37.1B.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now