c# - using QueryString in ASPX file -

-

i trying use sql command in aspx file capture querysring value having syntax issue. works fine when try filter querystring syntax issue. how can filter query using querystring? here code:

<asp:sqldatasource id="dd_ai_ds" runat="server"                connectionstring="<%$ connectionstrings:myconnectionstring %>"                selectcommand="select distinct [myfield] [mytable] id = '"+request.querystring[id]+"' order id asc" >           </asp:sqldatasource>

try instead:

<asp:sqldatasource id="dd_ai_ds" runat="server"     connectionstring="<%$ connectionstrings:myconnectionstring %>"     selectcommand="select distinct [myfield] [mytable] id = @id order id asc" >    <selectparameters>     <asp:querystringparameter name="id" querystringfield="post_id" type="string" />    </selectparameters> </asp:sqldatasource>

as aside, if code had written had worked have created security hole in website allowing sql injection. read on topic don't accidentally make websites open hackers.


Comments

Post a Comment

Popular posts from this blog

Issues changing the value of an element in an array in matlab -

-
i'm trying create program sum n-1 , n-2 numbers create n , store value in array. currently, output (assuming numdisp > 2 ) num1 , num2 , 0 , 0 , 0 ... size of array correct, i'm having issues reassigning elements. num1 = input('input first integer of fibonacci sequence: '); num2 = input('input second integer of fibonacci sequence: '); numsdisp = input('how many integers display? --> '); list = zeros(numsdisp,1); list(1) = num1; list(2) = num2; if (numsdisp <=0) disp('value must integer greater zero.') elseif (numsdisp == 1) disp(num1) elseif (numsdisp == 2) disp(num1) disp(num2) else disp(num1) disp(num2) index = 3:numsdisp disp(list(index)) list(index) = list((index-1)) + list((index-2)); end end example input: 3 3 4 corresponding output: 3 3 0 0 you aren't printing out final result, intermediate steps. in for loop, printing list(index) updating value, rather updat...
Read more

php - MySQLi binding parameters in a prepared statement doesn't work unless inserted after "WHERE" -

-
i have php code pulls info database. uses prepared statement, works fine written below: <?php $n = '5'; if ($stmt = $connection->prepare("select title items id = ?")) { $stmt->bind_param("s", $n); $stmt->execute(); $stmt->bind_result($title); while ($stmt->fetch()) { echo $title; } $stmt->close(); } ?> and let's echo "batman". however, when move placeholder here: "select ? items id = 5" and change: $n = 'title'; instead of echoing "batman", echoes "title". not possible use placeholder select parameter? what have done this: select "title" items id = 5 you cant use prepared statement bindings identifiers, parameters.
Read more

vb.net - Alternative to the T-SQL AS keyword -

-
please see code below: imports system.data.sqlclient imports system.configuration public class form1 private _constring string private sub form1_load(byval sender object, byval e system.eventargs) handles me.load dim objdr sqldatareader dim objcommand sqlcommand dim objcon sqlconnection dim id integer try _constring = configurationmanager.connectionstrings("testconnection").tostring objcon = new sqlconnection(_constring) objcommand = new sqlcommand("select person.urn, car.urn person inner join car on person.urn = car.urn , personid=1") objcommand.connection = objcon objcon.open() objdr = objcommand.executereader(connectionstate.closed) while objdr.read id = objdr("urn") 'line 19 loop objdr.close() ...
Read more