Here's my submission. Chris, you might want to edit a little on the display of links, line breaks or the code display. Because it's written for the newsletter, I hope the mentors cut me some slack for not
/*-----------------------------------------------
Use Format(), don't concatenate
-----------------------------------------------*/
Do you concatenate your SQL statements?
string sSQL = "update BlameLog"
+ " set me = '" + txtBlameDesc.Text + "'"
+ " where user_id = '" + txtUserID.Text + "'";
Oh the horror! The ugliness! Apparently you haven't read
about the exploits of a mom (http://xkcd.org/327/).
Nor have you maintained any applications where you need to
debug an SQL statement. Apparently. Try copying that into
your database editor and run it. Oh you can't? Because
you've got to remove all the idiotic plus signs and figure
out where all the single quotes are and where the double
quotes start and end.
Since you're obviously intent on exposing yourself to
SQL injection attacks and invite maintenance nightmares,
let me show you a better way.
string sSQL = string.Format("update BlameLog set me = '{0}' where user_id = '{1}'", txtBlameDesc.Text, txtUserID.Text);
Now at one glance, you know the structure of the SQL statement.
You can also easily copy the entire statement into your database
editor, make small changes to the parameters and you can run it.
The Format() function can take up to 3 parameters this way.
If you have more, then use this
object[] oaParams = { "up", "orcasquall" };
string sSQL = string.Format("update BlameLog set me = '{0}' where user_id = '{1}'", oaParams);
Dump your parameters into the object array. Then continue
numbering up the format items, so {6} refers to the 7th item.
I still hope you see the error of your ways, and use
proper SQL parameters...
Vincent (aka orcasquall)
http://polymathprogrammer.com/
11 Apr, 2008 - 08:56 AM
| 