Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Statments like <code>if (textBox4.Text == "" &amp;&amp; textBox2.Text == "")</code> means nothing at all, if you are not up to speed on what that particular part of the application is up to. In this case it seems as if they represent one value each, and that at least one of them should contain something for any operation to be legal. Studying the SQL statements suggests that <code>textBox2</code> is a quantity and <code>textBox4</code> is a price. First thing would be to change those control names into something more meaningful.</p> <p>Second, I'd wrap the checks into methods with more descriptive names:</p> <pre><code>private bool HasPriceValue() { return !string.IsNullOrEmpty(textBox4.Text); } private bool HasQuantityValue() { return !string.IsNullOrEmpty(textBox2.Text); } </code></pre> <p>Then you can rewrite the if-block as so:</p> <pre><code>if (!HasPriceValue() &amp;&amp; !HasQuantityValue()) { MessageBox.Show("No value entred for update."); } else { ConnectionClass.OpenConnection(); if (HasQuantityValue()) { SqlCommand cmd = new SqlCommand("update medicinerecord set quantity='" + textBox2.Text + "' where productid='"+comboBox1.Text+"'", ConnectionClass.OpenConnection()); cmd.ExecuteNonQuery(); } if (HasPriceValue()) { SqlCommand cmd = new SqlCommand("update myrecord set price='" + textBox4.Text + "' where productid='" + comboBox1.Text + "'", ConnectionClass.OpenConnection()); cmd.ExecuteNonQuery(); } ConnectionClass.CloseConnection(); } </code></pre> <p>This way you don't repeat the SQL queries in the code and it's fairly easy to read the code and understand what it does. The next step would be to rewrite the SQL queries to use parameters instead of concatenated strings (which opens your code for SQL injection attacks), <a href="https://stackoverflow.com/questions/6138301/how-can-i-refactor-this-method/6138413#6138413">as suggested by Darin</a>.</p>
    singulars
    1. This table or related slice is empty.
    1. POHow can I refactor this method?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USCommunity
    1. USFredrik Mörk
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POHow can I refactor this method?
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTAcceptedByOriginator
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COThanks for this great help next time i will keep in mind with meaningul name of controls. its realy worhty for me. And one thing its a simple window application and all operation will run in background so how is it underattack of SQLInjection.
      singulars
      1. PO
      1. USavirk
    2. CO@avirk: a user can enter specially crafted SQL commands into one of the text boxes and perform any kind of operation in the database (including dropping tables). See here for further explanation: [XKCD SQL injection - please explain](http://stackoverflow.com/questions/332365/xkcd-sql-injection-please-explain)
      singulars
      1. PO
      1. USFredrik Mörk
    3. COSo how can i prevent my application from it.
      singulars
      1. PO
      1. USavirk
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload