hi ,
i am creating a simple blog post application.For this i have created two tables .
1>tblBlogTopic( it contains the following fields: btopicId, btopicTitle, btopicDescription, bdatetime, empid)
2>tblBlogComment(it Contains the following fields:bCommentId,bCommentDescriptin, Empid, bcdatetime, btopicId )
In my application a user post his blog which will be seen in a list box. On selected index change of the listbox it will show the details of the topic in a reapeater control . If somebody wants to post a comment on a particular blog he can comment which should also be displayed in a same repeater control.
What should i do for it. I am having a problem in posting comment on a same repeater control .
I am really having confusion about it. how can i create it . plz help me on how can i do this....thanks in advance.
Loading
Amit ChoudharyPosted Feb 25, 2010, 4:11 AM
see you have made mistake while writing the query...
in your where condition "
where (btopicId='" + lstboxforblogtitle.SelectedValue + "')"
well i have made changes in your query now copy and paste it in to your code.
string MyQuery = "SELECT tblBlogTopic.btopicId, tblBlogTopic.btopicTitle, tblBlogTopic.btopicDescription, tblBlogComment.bCommentDescriptin, tblBlogComment.bcdatetime, tblBlogComment.Empid FROM tblBlogTopic INNER JOIN tblBlogComment ON tblBlogTopic.btopicId = tblBlogComment.btopicId where (tblBlogTopic.btopicId='" + lstboxforblogtitle.SelectedValue + "')";
Andrew FensterPosted Feb 25, 2010, 9:50 AM
string MyQuery = "SELECT tblBlogTopic.btopicId, tblBlogTopic.btopicTitle, tblBlogTopic.btopicDescription, tblBlogComment.bCommentDescriptin, tblBlogComment.bcdatetime, tblBlogComment.Empid FROM tblBlogTopic INNER JOIN tblBlogComment ON tblBlogTopic.btopicId = tblBlogComment.btopicId where (btopicId='" + lstboxforblogtitle.SelectedValue + "')";
I see a few issues:
(1) You are doing dynamic SQL, building a new SQL call each time you hit the database. There are two problems with this. First, it's vulnerable to SQL injection attacks. That is, eventually someone is going to figure out a way to pass in a value for btopicId which will include malicious code. They will wreck your database or steal your data. Second, this is incredibly demanding on the database. Each time you call the database, it has to analyze the query, verify that all the tables and columns you want exist, validate your SQL, build and compile a package and then execute it. It will have to do this each time you make a call.
The fix to both of those problems is to either use input parameters or stored procedures. Instead of saying btopicId = lstboxforblogtitle.SelectedValue, use an input parameter. Or even better, put all of this in a stored procedure. The database only has to compile the query one time, and it won't be vulnerable to SQL injection.
(2) Your query is written in a way that almost guarantees there will be errors. In fact you had an error, which Amit seems to have fixed. You should use simpler table and column names and better spacing to avoid such accidents:
SELECT topic.TopicID,
topic.Title,
topic.Description,
comment.Description,
comment.CreateDate,
comment.EmployeeID
FROM BlogTopic as topic INNER JOIN BlogComment as comment
ON topic.TopicID = comment.TopicID
WHERE (topic.TopicID = ...
See, I renamed the all the tables and columns. Why name something bCommentDescription when you can just name it Description? If it's in the BlogComment table, you already know it's a BlogComment. Simple and easy is always better, faster and less error prone.
Practice, practice, practice.
Ruchi RPosted Feb 25, 2010, 3:01 AM
I did like it.The following is for binding comments in the second repeater but i am getting an error(Ambiguous column name 'btopicId') in it.
protected void showYourComments()
{
string MyQuery = "SELECT tblBlogTopic.btopicId, tblBlogTopic.btopicTitle, tblBlogTopic.btopicDescription, tblBlogComment.bCommentDescriptin, tblBlogComment.bcdatetime, tblBlogComment.Empid FROM tblBlogTopic INNER JOIN tblBlogComment ON tblBlogTopic.btopicId = tblBlogComment.btopicId where (btopicId='" + lstboxforblogtitle.SelectedValue + "')";
string conn = ConfigurationSettings.AppSettings["Sqlconn"];
SqlConnection MyConn = new SqlConnection(conn);
SqlCommand Mycomm = new SqlCommand(MyQuery, MyConn);
try
{
MyConn.Open();
rptShowComment.DataSource = Mycomm.ExecuteReader();
rptShowComment.DataBind();
}
catch
{
throw;
}
finally
{
MyConn.Close();
Mycomm.Dispose();
}
}
Can you plz tell me why am getting this error.
Amit ChoudharyPosted Feb 25, 2010, 2:34 AM
as i understood your problem you have to take another repeater control associated with current blog that appears after selecting from the
ListBox.
and bind that repeater control with the join of two tables tblBlodTopic and tblBlogComment.
so as you change the blog by selecting another topic from listbox, comments on that blog will also changed.
Don't forget to mark the answer if it helps.