July 26, 2007 at 7:12 am
I'm trying to see both sides of the fence here... looks like I'll have to keep using the procs .
July 26, 2007 at 7:32 am
if u say my code is not very secure i agree since i am very new to this. But please let me know what else I can do |
As suggested, use stored procedures, or at least parameterized queries, e.g.
Dim sqlcomm1 As New SqlClient.SqlCommand
sqlcomm1.Connection = dbconn
sqlcomm1.CommandType = CommandType.Text
sqlcomm1.CommandText = "update D_task_det set str_date=@date,status='In_Progress' where pno=@pno and flag='0' and task=@task and status='Pending'"
sqlcomm1.Parameters.Add("@date", Now.Date())
sqlcomm1.Parameters.Add("@pno", pno)
sqlcomm1.Parameters.Add("@task", lbltask.Text.Trim())
sqlcomm1.ExecuteNonQuery()
Far away is close at hand in the images of elsewhere.
Anon.
July 26, 2007 at 9:52 pm
Thank u david. Now I changed the enableviewstate property of all controls in that page to true and readonly property of textboxes where we have date to false. Now it is working. But I have see that date textboxes should not be edited. What can u do?
July 27, 2007 at 5:15 pm
Thanks, Gail
--Jeff Moden
Change is inevitable... Change for the better is not.
July 30, 2007 at 1:40 am
Give them a calendar to pick the date from.
Check the date (isDate()) prior to writing
Return an error message if it is not a valid date
Users are never expected to type in a date. Give them a calendar.
Viewing 5 posts - 16 through 19 (of 19 total)
You must be logged in to reply to this topic. Login to reply