PC Review


Reply
Thread Tools Rate Thread

Re: First script - SQL Query

 
 
Jared
Guest
Posts: n/a
 
      10th Sep 2004
This assumes you have an asp:textbox on the form.
If it isn't a server-side control you can do can access it using
CType(FindControl("ControlID"), ControlType).PropertyToAccess
For example - with a DropDownList:
Dim MyValue As String = CType(Me.FindControl("DropDownList1"),
DropDownList).SelectedValue
- or -
DropDownList1.SelectedValue

Be careful when you do this, an attacker can use sql injection to delete
your database, or worse.
Sub SubmitBtn_Click(Sender As Object, E As EventArgs)

Dim DS As DataSet
Dim MyConnection As SqlConnection
Dim MyCommand As SqlDataAdapter

MyConnection = New
SqlConnection("server=wfsnt62;database=SecurityInfo;User
Id=sa;Password=wfssa62;Trusted_Connection=False")
MyCommand = New SqlDataAdapter("select UserName, roleName, DBName,
Title, EmpNo, " _
& "CostCenter from UserInfo where MSName = '" & UserID.Text & "'",
myConnection)

End Sub

"rondebbs" <(E-Mail Removed)> wrote in message
news:ED4798D4-0E8E-4491-932A-(E-Mail Removed)...
> Hello, below is my first attempt at programming (actually copying someone
> elses script and modifying it for my needs). My sql statement is hard
> coded
> with -
> where MSName = 'br17348'. I really want the where clause to use the value
> in
> the User ID field. How do I dynamically pick up the value entered in User
> ID
> of this page for my query? I have not been able to get the syntax correct.
>
> Thanks - Brad
>
> <%@ Import Namespace="System.Data" %>
> <%@ Import Namespace="System.Data.SqlClient" %>
>
> <html>
> <head>
> <link rel="stylesheet"href="intro.css">
> </head>
>
> <script language="VB" runat=server>
>
> Sub SubmitBtn_Click(Sender As Object, E As EventArgs)
>
> Dim DS As DataSet
> Dim MyConnection As SqlConnection
> Dim MyCommand As SqlDataAdapter
>
> MyConnection = New
> SqlConnection("server=wfsnt62;database=SecurityInfo;User
> Id=sa;Password=wfssa62;Trusted_Connection=False")
> MyCommand = New SqlDataAdapter("select UserName, roleName, DBName, Title,
> EmpNo, CostCenter from UserInfo where MSName = 'br17348'", myConnection)
>
>
>
> DS = new DataSet()
> MyCommand.Fill(DS, "UserInfo")
>
> MyList.DataSource = DS.Tables("UserInfo").DefaultView
> MyList.DataBind()
>
> End Sub
>
>
> </script>
>
> <body>
>
> <center>
>
> <form action="Brad.aspx" method="post" runat="server">
>
> <h3> User Id: <asp:textbox id="Name" runat="server"/>
>
>
> </h3>
>
> <asp:button text="Lookup" OnClick="SubmitBtn_Click" runat="server"/>
>
> <p>
>
> <ASPataGrid id="MyList" HeaderStyle-BackColor="#aaaadd"
> BackColor="#ccccff"
> runat="server"/>
>
> </form>
>
> </center>
>
> </body>
>
> </html>
>



 
Reply With Quote
 
 
 
 
Jared
Guest
Posts: n/a
 
      10th Sep 2004
Sorry, I didn't read far enough.

Replace UserID.Text with Name.Text

"Jared" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> This assumes you have an asp:textbox on the form.
> If it isn't a server-side control you can do can access it using
> CType(FindControl("ControlID"), ControlType).PropertyToAccess
> For example - with a DropDownList:
> Dim MyValue As String = CType(Me.FindControl("DropDownList1"),
> DropDownList).SelectedValue
> - or -
> DropDownList1.SelectedValue
>
> Be careful when you do this, an attacker can use sql injection to delete
> your database, or worse.
> Sub SubmitBtn_Click(Sender As Object, E As EventArgs)
>
> Dim DS As DataSet
> Dim MyConnection As SqlConnection
> Dim MyCommand As SqlDataAdapter
>
> MyConnection = New
> SqlConnection("server=wfsnt62;database=SecurityInfo;User
> Id=sa;Password=wfssa62;Trusted_Connection=False")
> MyCommand = New SqlDataAdapter("select UserName, roleName, DBName,
> Title, EmpNo, " _
> & "CostCenter from UserInfo where MSName = '" & UserID.Text & "'",
> myConnection)
>
> End Sub
>
> "rondebbs" <(E-Mail Removed)> wrote in message
> news:ED4798D4-0E8E-4491-932A-(E-Mail Removed)...
>> Hello, below is my first attempt at programming (actually copying someone
>> elses script and modifying it for my needs). My sql statement is hard
>> coded
>> with -
>> where MSName = 'br17348'. I really want the where clause to use the value
>> in
>> the User ID field. How do I dynamically pick up the value entered in User
>> ID
>> of this page for my query? I have not been able to get the syntax
>> correct.
>>
>> Thanks - Brad
>>
>> <%@ Import Namespace="System.Data" %>
>> <%@ Import Namespace="System.Data.SqlClient" %>
>>
>> <html>
>> <head>
>> <link rel="stylesheet"href="intro.css">
>> </head>
>>
>> <script language="VB" runat=server>
>>
>> Sub SubmitBtn_Click(Sender As Object, E As EventArgs)
>>
>> Dim DS As DataSet
>> Dim MyConnection As SqlConnection
>> Dim MyCommand As SqlDataAdapter
>>
>> MyConnection = New
>> SqlConnection("server=wfsnt62;database=SecurityInfo;User
>> Id=sa;Password=wfssa62;Trusted_Connection=False")
>> MyCommand = New SqlDataAdapter("select UserName, roleName, DBName, Title,
>> EmpNo, CostCenter from UserInfo where MSName = 'br17348'", myConnection)
>>
>>
>>
>> DS = new DataSet()
>> MyCommand.Fill(DS, "UserInfo")
>>
>> MyList.DataSource = DS.Tables("UserInfo").DefaultView
>> MyList.DataBind()
>>
>> End Sub
>>
>>
>> </script>
>>
>> <body>
>>
>> <center>
>>
>> <form action="Brad.aspx" method="post" runat="server">
>>
>> <h3> User Id: <asp:textbox id="Name" runat="server"/>
>>
>>
>> </h3>
>>
>> <asp:button text="Lookup" OnClick="SubmitBtn_Click" runat="server"/>
>>
>> <p>
>>
>> <ASPataGrid id="MyList" HeaderStyle-BackColor="#aaaadd"
>> BackColor="#ccccff"
>> runat="server"/>
>>
>> </form>
>>
>> </center>
>>
>> </body>
>>
>> </html>
>>

>
>



 
Reply With Quote
 
=?Utf-8?B?cm9uZGViYnM=?=
Guest
Posts: n/a
 
      10th Sep 2004
Jared - Works great! Thanks

"Jared" wrote:

> Sorry, I didn't read far enough.
>
> Replace UserID.Text with Name.Text
>
> "Jared" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > This assumes you have an asp:textbox on the form.
> > If it isn't a server-side control you can do can access it using
> > CType(FindControl("ControlID"), ControlType).PropertyToAccess
> > For example - with a DropDownList:
> > Dim MyValue As String = CType(Me.FindControl("DropDownList1"),
> > DropDownList).SelectedValue
> > - or -
> > DropDownList1.SelectedValue
> >
> > Be careful when you do this, an attacker can use sql injection to delete
> > your database, or worse.
> > Sub SubmitBtn_Click(Sender As Object, E As EventArgs)
> >
> > Dim DS As DataSet
> > Dim MyConnection As SqlConnection
> > Dim MyCommand As SqlDataAdapter
> >
> > MyConnection = New
> > SqlConnection("server=wfsnt62;database=SecurityInfo;User
> > Id=sa;Password=wfssa62;Trusted_Connection=False")
> > MyCommand = New SqlDataAdapter("select UserName, roleName, DBName,
> > Title, EmpNo, " _
> > & "CostCenter from UserInfo where MSName = '" & UserID.Text & "'",
> > myConnection)
> >
> > End Sub
> >
> > "rondebbs" <(E-Mail Removed)> wrote in message
> > news:ED4798D4-0E8E-4491-932A-(E-Mail Removed)...
> >> Hello, below is my first attempt at programming (actually copying someone
> >> elses script and modifying it for my needs). My sql statement is hard
> >> coded
> >> with -
> >> where MSName = 'br17348'. I really want the where clause to use the value
> >> in
> >> the User ID field. How do I dynamically pick up the value entered in User
> >> ID
> >> of this page for my query? I have not been able to get the syntax
> >> correct.
> >>
> >> Thanks - Brad
> >>
> >> <%@ Import Namespace="System.Data" %>
> >> <%@ Import Namespace="System.Data.SqlClient" %>
> >>
> >> <html>
> >> <head>
> >> <link rel="stylesheet"href="intro.css">
> >> </head>
> >>
> >> <script language="VB" runat=server>
> >>
> >> Sub SubmitBtn_Click(Sender As Object, E As EventArgs)
> >>
> >> Dim DS As DataSet
> >> Dim MyConnection As SqlConnection
> >> Dim MyCommand As SqlDataAdapter
> >>
> >> MyConnection = New
> >> SqlConnection("server=wfsnt62;database=SecurityInfo;User
> >> Id=sa;Password=wfssa62;Trusted_Connection=False")
> >> MyCommand = New SqlDataAdapter("select UserName, roleName, DBName, Title,
> >> EmpNo, CostCenter from UserInfo where MSName = 'br17348'", myConnection)
> >>
> >>
> >>
> >> DS = new DataSet()
> >> MyCommand.Fill(DS, "UserInfo")
> >>
> >> MyList.DataSource = DS.Tables("UserInfo").DefaultView
> >> MyList.DataBind()
> >>
> >> End Sub
> >>
> >>
> >> </script>
> >>
> >> <body>
> >>
> >> <center>
> >>
> >> <form action="Brad.aspx" method="post" runat="server">
> >>
> >> <h3> User Id: <asp:textbox id="Name" runat="server"/>
> >>
> >>
> >> </h3>
> >>
> >> <asp:button text="Lookup" OnClick="SubmitBtn_Click" runat="server"/>
> >>
> >> <p>
> >>
> >> <ASPataGrid id="MyList" HeaderStyle-BackColor="#aaaadd"
> >> BackColor="#ccccff"
> >> runat="server"/>
> >>
> >> </form>
> >>
> >> </center>
> >>
> >> </body>
> >>
> >> </html>
> >>

> >
> >

>
>
>

 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
QUERY: export script KevinGPO Microsoft Outlook VBA Programming 3 1st Mar 2006 02:38 PM
VB script to query AD Jason Microsoft Windows 2000 Active Directory 4 24th Sep 2004 09:06 PM
Script query KiwiBrian Microsoft Excel Discussion 2 28th Aug 2004 09:23 AM
script query reiks Microsoft Dot NET 1 7th Jan 2004 03:12 PM
Query from VB script Milos Puchta Microsoft Windows 2000 CMD Promt 0 30th Oct 2003 09:50 AM


Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 05:57 PM.