Solved

VB.Net - Search String for Character and Add Single Quotes

Posted on 2014-10-06
5
391 Views
Last Modified: 2014-10-08
Good Day Experts!

I have a VB.Net form that takes User input and retrieves records from a SQL database for display in a DataGrid.

I need to allow the User to enter multiple values in on2 of the textboxes.  My plan was to tell the User to enter just a single value or multiples separated by a comma.  I have my query behind the "Get Records" button built to accept
where in ('Value1','Value3'...etc).

I was going to iterate through the string until each comma was encountered then add a starting/ending single quote around the value then put the string back together.  

Question:

Can you think of any functions that may help me achieve this end goal in the simplest fashion?

Thanks,
jimbo99999
0
Comment
Question by:Jimbo99999
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 40

Accepted Solution

by:
Jacques Bourgeois (James Burger) earned 500 total points
ID: 40365320
Dim values As String = "One,Two,Three"
            values = "'" & values.Replace(",", "','") & "'"
0
 
LVL 11

Expert Comment

by:louisfr
ID: 40365375
As always when injecting user input into SQL, use a parameterized query.
        Dim csv = "value1,value2,value3"
        Dim values = csv.Split(",")
        Dim cmd = New SqlCommand()
        For i As Integer = 0 To values.Length - 1
            cmd.Parameters.AddWithValue(i.ToString("'@p'0"), values(i))
        Next
        cmd.CommandText = "select ... where in (" + String.Join(",", Enumerable.Range(0, values.Length).Select(Function(i) i.ToString("'@p'0"))) + ");"

Open in new window

0
 

Author Comment

by:Jimbo99999
ID: 40367545
Thanks for your responses.  I am working on the project this evening.

jimbo99999
0
 

Author Closing Comment

by:Jimbo99999
ID: 40368126
Thanks James...I did not go down that path of thought process to achieve the end goal.  It is working great now.

jimbo99999
0
 
LVL 11

Expert Comment

by:louisfr
ID: 40368618
It's working great until someone puts "blabla'); drop table VeryImportantTable; --" in your input string.
0

Featured Post

Salesforce Made Easy to Use

On-screen guidance at the moment of need enables you & your employees to focus on the core, you can now boost your adoption rates swiftly and simply with one easy tool.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Microsoft Reports are based on a report definition, which is an XML file that describes data and layout for the report, with a different extension. You can create a client-side report definition language (*.rdlc) file with Visual Studio, and build g…
Calculating holidays and working days is a function that is often needed yet it is not one found within the Framework. This article presents one approach to building a working-day calculator for use in .NET.
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
This tutorial will teach you the special effect of super speed similar to the fictional character Wally West aka "The Flash" After Shake : http://www.videocopilot.net/presets/after_shake/ All lightning effects with instructions : http://www.mediaf…
Suggested Courses

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question