/// <summary>
/// method for loading banned words from an
/// XML document into a generic list (List(T)
/// </summary>
/// <param name="file">the file that holds the banned words</param>
/// <returns></returns>
public static List<string> BadWordList(ref string file)
{
    //create a new List(T) for holding the words
    List<string> words = new List<string>();

    //create a new XmlDocument, this will read our XML file
    XmlDocument xmlDoc = new XmlDocument();

    //here is where XPath comes into play, when we use
    //SelectNodes we will pass this XPath query into it
    //so we can navigate straight to the nodes we want
    string query = "/WordList/word";

    //now load the XML document
    xmlDoc.Load(file);

    //loop through all the XmlNodes that meet our XPath criteria
    foreach (XmlNode node in xmlDoc.SelectNodes(query))
    {
        //add the InnerText of each ChildNodes we find
        words.Add(node.ChildNodes[0].InnerText);
    }

    //return the populated List(T)
    return words;
}

/// <summary>
/// method for determining if the provided word is in
/// the banned word list
/// </summary>
/// <param name="word">the word we are looking for</param>
/// <param name="file">file name containing the words we're to search against</param>
/// <returns></returns>
public bool IsBadWord(ref string word, ref string file)
{
    //create a new List(T) to hold the words. Then populate the list
    //by calling the BadWordList method in the IOManager class
    List<string> badWords = IOManager.BadWordList(ref file);

    //now we need a loop as long as the words count
    for (int i = 0; i < badWords.Count; i++)
    {
        //on each iteration we compare the two (1 provided, 1 from the List(T))
        //to see if they match. If they do then return true and exit the loop
        if (word.ToLower() == badWords[i].ToLower()) return true;
    }

    //we made it through the entire list and no match found
    //so we return false as this word isnt a banned word
    return false;
}

public bool CompleteTagRequest(string uid, string tagID, string name, ref string file)
{
    string query = "uspRequestTag";
    int rows = 0;


    //first we need to make sure the user did try to use a word in our list
    if (!(IsBadWord(ref name, ref file)))
    {
        //they are clean so move on
        try
        {
            //create our SqlConnection object
            using (SqlConnection conn = new SqlConnection(GetConnectionString("MyConnectionName")))
            {
                //create our SqlCommand
                SqlCommand cmd = new SqlCommand();

                //set the CommandText and CommandType properties
                cmd.CommandType = CommandType.StoredProcedure;
                cmd.CommandText = query;

                //now add our parameters
                cmd.Parameters.AddWithValue("@user_uid", uid);
                cmd.Parameters.AddWithValue("@tag_uid", tagID.Substring(3));
                cmd.Parameters.AddWithValue("@name_on_tag", name);
                cmd.Connection = conn;

                //now open the connection
                cmd.Connection.Open();

                rows = Convert.ToInt32(cmd.ExecuteScalar().ToString());

                if (!(rows > 0)) return false;
                else return true;
            }
        }
        catch (SqlException ex)
        {
            _message = ex.Message;
            return false;
        }
        catch (Exception ex)
        {
            _message = ex.Message;
            return false;
        }
    }
    else
    {
        //since we're here they obviously attempted to use one of the banned words
        //so we need to let them know and possibly send goons with baseball bats to find them,
        //well that last part isnt really true
        _message = "We're sorry, that name is not allowed. Please try a different name";
        return false;
    }            
}

/// <summary>
/// method to retrieve the database connection string from the web.config
/// </summary>
/// <param name="name">name of the connection string we want (this allows us to have multiple if needed)</param>
/// <returns></returns>
public string GetConnectionString(string name)
{
    try
    {
        //variable to hold our connection string for returning it
        string connString = string.Empty;
        //check to see if the user provided a connection string name
        //this is for if your application has more than one connection string
        if (!(string.IsNullOrEmpty(name))) //a connection string name was provided
        {
            //get the connection string by the name provided
            connString = ConfigurationManager.ConnectionStrings[AntiXss.HtmlEncode(name)].ConnectionString;
        }
        else //no connection string name was provided
        {
            
            //get the default connection string
            connString = ConfigurationManager.ConnectionStrings["DefaultConnection"].ConnectionString;
        }
        //return the connection string to the calling method
        return connString;
    }
    catch (Exception ex)
    {
        return string.Empty;
    }
}