Dear experts,
I would like to know what are @fn,@tel, @eml are ?
Are these names we just anyhow gave ? If not where on earth it came from ?
- protected void btnCreate_Click(object sender, EventArgs e)
- {
- DAO.MembersDAO memDAO = new DAO.MembersDAO();
- string sql = "INSERT INTO member VALUES (@fn, @tel, @eml)";
- //SqlParameterCollection spc = null;
- //spc.Add(new SqlParameter("@fn", SqlDbType.NVarChar)).Value = txtFullName.Text;
- //spc.Add(new SqlParameter("@tel", SqlDbType.NVarChar)).Value = txtTel.Text;
- //spc.Add(new SqlParameter("@eml", SqlDbType.NVarChar)).Value = txtEmail.Text;
- SqlParameter[] spa = new SqlParameter[3];
- spa[0] = new SqlParameter("@fn", SqlDbType.NVarChar);
- spa[0].Value = txtFullName.Text;
- spa[1] = new SqlParameter("@tel", SqlDbType.NVarChar);
- spa[1].Value = txtTel.Text;
- spa[2] = new SqlParameter("@eml", SqlDbType.NVarChar);
- spa[2].Value = txtEmail.Text;
- int result = memDAO.InsertMember(sql, spa);
- if (result == 1)
- {
- Response.Redirect("MemberList.aspx");
- }
Ranjit PowarPosted Oct 31, 2016, 11:44 PM
Francis SusaimichaelPosted Nov 1, 2016, 11:17 AM
Tangara GPosted Nov 1, 2016, 10:32 AM
Bikesh SrivastavaPosted Nov 1, 2016, 8:31 AM
Prakash KumarPosted Nov 1, 2016, 12:13 AM
Ranjit PowarPosted Oct 31, 2016, 11:44 PM
Manas MohapatraPosted Oct 31, 2016, 2:45 PM
@tel - It relates to Telephone number
@eml - It relates to Email
These are SQL parameters names which you are passing to execute SQL query.
It looks you are using inline query, so you should use parameterised to avoid SQL injection.
SQL parameters are used in Inline SQL queries or calling the Stored procedure.
Secongly the parameters names should same as SQL query param names.
Tangara GPosted Oct 31, 2016, 11:59 AM
Pradeep SahooPosted Oct 31, 2016, 9:19 AM
Salman BegPosted Oct 31, 2016, 9:16 AM