Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 General SQL Server Forums
 New to SQL Server Programming
 Need to hard code 2 customers

Author  Topic 

AdamWest
Constraint Violating Yak Guru

360 Posts

Posted - 2010-06-07 : 12:58:06
in this sql I am getting the customers who belong to a particular user. i need to filter out 2 customers from this list, called 'Northern' and 'Norther group' and am not sure how to do this.
later I will fix the structure of the db to handle it but this is at a apoint that it needs to go in live now.

string sql = "Select * from Users U INNER JOIN UserReports UR ON U.UserName = UR.UserName where UR.ReportCode='R12' AND U.UserName = '" + Request.Params["uname"].Replace("'", "") + "' and Password = '" + Request.Params["pwd"].Replace("'", "") + "'";
DataSet ds = Lib.GetResults(sql, ConnectionHelper.GetSecurityDatabaseConnection());

if (ds != null)
{
if (ds.Tables.Count > 0)
{
if (ds.Tables[0].Rows.Count == 1)
{
Session["UserName"] = Request.Params["uname"].Trim();
Response.Redirect("Default.aspx");
}
else
{
lblMessage.Text = "Invalid UserName/Password.";
}

jimf
Master Smack Fu Yak Hacker

2875 Posts

Posted - 2010-06-07 : 13:07:55
the sql part would be AND U.UserName not in ('Northern','Norther Group')

Jim

Everyday I learn something that somebody else already knew
Go to Top of Page

AdamWest
Constraint Violating Yak Guru

360 Posts

Posted - 2010-06-07 : 16:49:31
Where would I put that? right before the R12 check?
Go to Top of Page

tkizer
Almighty SQL Goddess

38200 Posts

Posted - 2010-06-07 : 16:53:22
You should read about SQL injection as the code you have posted is vulnerable to it. Instead of concatenating together your SQL, you should be using parameterized queries.

Tara Kizer
Microsoft MVP for Windows Server System - SQL Server
http://weblogs.sqlteam.com/tarad/

Subscribe to my blog
Go to Top of Page

madhivanan
Premature Yak Congratulator

22864 Posts

Posted - 2010-06-08 : 02:56:09
quote:
Originally posted by tkizer

You should read about SQL injection as the code you have posted is vulnerable to it. Instead of concatenating together your SQL, you should be using parameterized queries.

Tara Kizer
Microsoft MVP for Windows Server System - SQL Server
http://weblogs.sqlteam.com/tarad/

Subscribe to my blog


or use Derived table
http://beyondrelational.com/blogs/madhivanan/archive/2010/05/14/derived-table-new-approach-to-avoid-sql-injection.aspx

Madhivanan

Failing to plan is Planning to fail
Go to Top of Page
   

- Advertisement -