Posts

Showing posts with the label Stored Procedure

How to use Enterprise Library using C#

Summary The Microsoft Enterprise Library is a collection of reusable software components (application blocks) designed to assist software developers with common enterprise development cross-cutting concerns (such as logging, validation, data access, exception handling, and many others). Application blocks are a type of guidance; they are provided as source code, test cases, and documentation that can be used "as is," extended, or modified by developers to use on complex, enterprise-level line-of-business development projects. Some Features While using enterprise library you have to concern about opening and closing connections. This will automatically handle connection pooling and other important errors of connection and database. I had used Enterprise Library 2.0 - January 2006. To use Enterprise Library you required to add reference of following files:- Microsoft.Practices.EnterpriseLibrary.Common.dll Microsoft.Practices.EnterpriseLibrary.Configuration.De...

What is SQL Injection Attack Part -II

Recommended reading part I Use Type-Safe SQL Parameters The Parameters collection in SQL Server provides type checking and length validation. If you use the Parameters collection, input is treated as a literal value instead of as executable code. An additional benefit of using the Parameters collection is that you can enforce type and length checks. Values outside the range will trigger an exception. The following code fragment shows using the Parameters collection: SqlDataAdapter myCommand = new SqlDataAdapter("AuthorLogin", conn); myCommand.SelectCommand.CommandType = CommandType.StoredProcedure; SqlParameter parm = myCommand.SelectCommand.Parameters.Add("@au_id",SqlDbType.VarChar, 11); parm.Value = Login.Text; In this example, the @au_id parameter is treated as a literal value instead of as executable code. This value is checked for type and length. If the value of @au_id does not comply with the specified type and length constraints, an exception will be thrown....

What is SQL Injection Attack

When first time I had heard about SQL Injection attack, I got afraid what the thing about, who can even insert, select and drop my tables from my database. After searching on internet and visiting many of website I came to some of the conclusions. What is SQL injection attack? SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. Any procedure that constructs SQL statements should be reviewed for injection vulnerabilities because SQL Server will execute all syntactically valid queries that it receives. Even parameterized data can be manipulated by a skilled and determined attacker. The primary form of SQL injection consists of direct insertion of code into user-input variables that are concatenated with SQL commands and executed. A less direct attack injects malicious code into strings that are destined for storage in a table or as metadata. When the stored strings are subsequently conca...

Tips For Database Optimization/Operations with C#

Recommended reading C# optimization tips 1) Return Multiple Resultsets The database code if has request paths that go to the database more than once then, these round-trips decreases the number of requests per second your application can serve. Solution: Return multiple resultsets in a single database request, so that you can cut the total time spent communicating with the database. You'll be making your system more scalable, too, as you'll cut down on the work the database server is doing managing requests. 2) Connection Pooling and Object Pooling Connection pooling is a useful way to reuse connections for multiple requests, rather than paying the overhead of opening and closing a connection for each request. It's done implicitly, but you get one pool per unique connection string. Make sure you call Close or Dispose on a connection as soon as possible. When pooling is enabled, calling Close or Dispose returns the connection to the pool instead of closing the underlying dat...

How to make user in Sql server database.

Image
To make a user in sql server you have the rights. to create user go to Security=>> Logins>> Right click on Logins Login Name : jayant Select option:Sql server authentication Un check : Enforece password policy. Refer Image Below Now close sql management studio and re login with jayant Try to access other databases, it will show error, means you have sucessfuly make a new use for new datbase.

SQL Server Stored Procedure paging with .net

We face Paging problem while working with datalist. Datalist does not support paging like grid. Here, is the solution for this major problem. use Sql server stored procedure to get proper paging which we can call from Dot Net Suppose I have a Table master Contains Fields "UserName,Code, Address1,FatherName" etc. To Make this ex. working follow steps 1) Make New Database 2) Create Table Master 3) Create Fields UserName Nvarchar(50), Code Nvarchar(50), Address1 Nvarchar(50), FatherName Nvarchar(50) 4) Then run following command is sql query window. 5) After creating this exec [Get_Records] 1,10 6) First param stands for pageno and second is for No. of records per page. -- ============================================= Create PROCEDURE [dbo].[Get_Records] @Int_PageNo int,@Int_RecordPerPage int AS BEGIN Declare @Int_From_Page int,@int_To_Page int,@Int_Total_Records int /***********************************************/ set @Int_From_Page=((@Int_PageNo-1)*@Int_RecordPerPage)+1...