passing parameters from text box to sql

[gordon]

Hi

I have a text boxe that passes its contents to a select command that is used
in a where statement - - - WHERE name like '%" + input + "%'.

I am concerned that it may be possible for someone to do some damage to my
dataset by passing dubious parameters. Is there some way to work around
this program security issue? I am using the OleDbDataAdapter with a MS
Access database.

Any advice appreciated.

Thanks

 

[Greg Young]

Yes use a parameterized query ...

http://www.4guysfromrolla.com/webtech/092601-1.shtml includes an example
using ASP.NET but its the same for other environments ...

Cheers,

Greg Young
MVP - C#
http://codebetter.com/blogs/gregyoung

 

[Jianwei Sun]

Is it possible that you can validate those input ?

 

[Jon Skeet [C# MVP]]

I have a text boxe that passes its contents to a select command that is used
in a where statement - - - WHERE name like '%" + input + "%'.

I am concerned that it may be possible for someone to do some damage to my
dataset by passing dubious parameters. Is there some way to work around
this program security issue? I am using the OleDbDataAdapter with a MS
Access database.

Any advice appreciated.

See http://www.pobox.com/~skeet/csharp/faq/#db.parameters

 

[gordon]

Thanks for the links and the advice.

I have a bit of reading to do tonight now!!!

Doug