How to properly format date fields coming out of an MS SQL database

rwheeler23
rwheeler23 used Ask the Experts™
on
I have this SQL command and the aplydate and glpostdt fields are dates.

DataCommand.CommandText = "select aplydate,glpostdt,distref from job_linker where companyid = '" + CompanyID + "' and bchsourc = 'Apply_Documents' and transnmbr ='" + ApplyToVoucherNumber + "' and trxtype = 'Apply Payments ' and dstsqnum = 16384 and cntrltyp = 0 and aptvchnm = '" + ApplyToDocumentNumber + "' and spcldist = 0 and len(rtrim(jobnumber))>0";

I obtain the values with this code

                DataDataAdapter = new System.Data.SqlClient.SqlDataAdapter();
                DataDataAdapter.SelectCommand = DataCommand;
                DataDataAdapter.TableMappings.Add("Table", "DISTREF");

                this.txtApplyDate.DataBindings.Add("Text", DataDataSet.Tables["DISTREF"], "aplydate").ToString();
                this.txtApplyPostingDate.DataBindings.Add("Text", DataDataSet.Tables["DISTREF"], "glpostdt").ToString();

It is the last two lines where I am stumped. I want the format of the dates to be MM/dd/yyyy.  When I try
                this.txtApplyDate.DataBindings.Add("Text", DataDataSet.Tables["DISTREF"], "aplydate").ToString("MM/dd/yyyy")
I receive an error.

What is the correct way to format these date fields?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
View Solutions Only
Senior .Net Developer
Commented:
I would normally do this from the SQL side

select  convert(varchar(12), aplydate, 101) as aplydate, ...

Open in new window


Note that the sql query itself looks vulnerable to sql injection.

If you wanted to do it to the dataBinding side:

txtApplyDate.DataBindings.Add("Text", DataDataSet.Tables["DISTREF"], "aplydate",true, DataSourceUpdateMode.OnPropertyChanged, "1/1/1900", "MM/dd/yyyy")

Open in new window

rwheeler23President

Author

Commented:
Thanks. That is something else I need to read up on, sql injection.
rwheeler23President

Author

Commented:
So from a sql injection side, is it better to do the conversion on the data binding side? No data input is happening on the user side with this query.  Is it still susceptible to sql injection?
OWASP Proactive Controls

Learn the most important control and control categories that every architect and developer should include in their projects.

Start Today!
AndyAinscowFreelance programmer / Consultant
Commented:
this.txtApplyDate.DataBindings.Add("Text", DataDataSet.Tables["DISTREF"], "aplydate").ToString("MM/dd/yyyy")

You are applying the ToString to the DataBindings.Add, I think you want:
this.txtApplyDate.DataBindings.Add(("Text", DataDataSet.Tables["DISTREF"], "aplydate").ToString("MM/dd/yyyy"))
or something along those lines
Kyle AbrahamsSenior .Net Developer

Commented:
If there's no user input then no need to worry about sql injection.  Saw the variables, didn't know where they were coming from.
rwheeler23President

Author

Commented:
Thnaks

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial