duplicates? before inserting in dataset

[Pascal]

Hello
I am trying to create a small application where the user must identify
before he begins. If it has never used the application, it identifies
creating a new user : firtsname + name + date of birth.
I created a form on which I drag and drop the table Eleves from my dataset
calcul_mentalDataSet from the database calcul_mental.mdb. As mentioned here:
http://plasserre.developpez.com/v6-6.htm in french....
I'd like to verify that the user does not exist prior to his registration.
Here is the current code:

Private Sub ElevesBindingNavigatorSaveItem_Click(ByVal sender As
System.Object, ByVal e As System.EventArgs) Handles
ElevesBindingNavigatorSaveItem.Click
Try
Me.ElevesBindingSource.EndEdit()
If Me.Validate Then
If VerifUserExist() = True Then 'Utilisateur déjà inscrit
MessageBox.Show("Utilisateur déjà inscrit", "ATTENTION
!", MessageBoxButtons.OK, MessageBoxIcon.Stop)
Else 'on met à jour la base
UpdateDatabase()
ModuleIdentite.MonNOM = NomTextBox.Text ' je mets
l'identité en mémoire dans le module accessible de partout
ModuleIdentite.MonPrenom = PrenomTextBox.Text
Frm_main_mdi.Text = "Bienvenue chez SC@LPA, " &
PrenomTextBox.Text & " !"
Frm_main_mdi.ActivitesToolStripMenuItem.Enabled = True
'l'élève est identifié alors il a accès au menu
Me.Close()
End If

End If
Catch ex As Exception
MessageBox.Show(ex.Message, "Inscription", MessageBoxButtons.OK,
MessageBoxIcon.Stop)
End Try

End Sub
''' <summary>
''' Update changes in Students table to database
''' </summary>
Private Sub UpdateDatabase()
Try
Me.ElevesTableAdapter.Update(Me.Calcul_mentalDataSet.Eleves)
Catch ex As Exception
MessageBox.Show(ex.Message, "Liste des éleves mise à jour",
MessageBoxButtons.OK, MessageBoxIcon.Stop)
End Try
End Sub

Function VerifUserExist() As Boolean
'Je récupère les infos entrées dans les différents textboxes
Dim strNom As String = NomTextBox.Text
Dim strPrenom As String = PrenomTextBox.Text
Dim dteDdn As String = DdnDateTimePicker.Value.ToString
'afin de les comparer à la table
Dim strSQL As String = "SELECT Nom, Prenom, Ddn FROM Eleves WHERE
Nom ='strNom' and Prenom ='strPrenom' and Ddn =#dteDdn#"
'#######################################################################
'# 'i don't have any idea on how to handle the comparaison between
things entered by user and the database
#
'#######################################################################
If True Then
Return True
Else
Return False
End If

End Function

thanks for your help
pascal

 

[sloan]

This is subject to sql injection:

Dim strSQL As String = "SELECT Nom, Prenom, Ddn FROM Eleves WHERE
Nom ='strNom' and Prenom ='strPrenom' and Ddn =#dteDdn#"

Go here:
http://sholliday.spaces.live.com/Blog/cns!A68482B9628A842A!176.entry

and find the Access example (permutation) (since you mention a mdb file)
public virtual IDataReader
OrdersGetAllForSpecificCustomerReader(string customerId)


That shows how to use parameters into an Access database.


See
http://en.wikipedia.org/wiki/SQL_injection