Is this the most efficient/fastest code to use? (beginner sql question)

  • Thread starter Thread starter Jeff
  • Start date Start date
J

Jeff

....another beginnger question.
I have a web application in .net v2 VB that requires multiple reads from sql tables where
each read is slightly different - so the sql select statements also differ frequently. I've created a
few functions in an .ascx file to handle these reads and send them back to the main code.

2 examples are below. Each works - the first returns a single integer value, the second returns the entire row
that contains a mix of integers, boolean, and strings. Other similiar functions I've written write data using slightly
different versions for writing strings or integers.

Because I'm using these or similar functions frequently in the application, I'm wondering whether this is the best way to accomplish
these tasks or whether there is a faster, more efficient method to do what I'm doing. Comments?

Thanks in advance
Jeff

Function GetIntAnswer(ByVal CurrQuestion As String) As Integer
Dim TableP As System.Data.DataView
Dim sb As New StringBuilder("select ")
sb.Append(CurrQuestion)
sb.Append(" from Answers where ID = ")
sb.Append(Session("ID"))
SqlAnswers.SelectCommand = sb.ToString
TableP = SqlAnswers.Select(DataSourceSelectArguments.Empty)
Return TableP.Item(0)(0)
End Function

Function GetInfo() As System.Data.DataView
Dim sb As New StringBuilder("select * from Questions where QuestionNu = ")
sb.Append(Session("QuestionPointer"))
SqlQuestions.SelectCommand = sb.ToString
Return SqlQuestions.Select(DataSourceSelectArguments.Empty)
End Function
 
Hello Jeff,

All together now, smile and say, "SQL INJECTION ATTACK!" *click*.

Become intimately familliar with SqlParameter and SqlCommand.

-Boo
 
I've done some small amount of reading about injection attacks and have the general idea. Could you help out someone new and give me
a bit more detail about what the vulnerability here is and a bit more detail about how to address it? If you're speaking about the
fact that there are text boxes, yes, I'm aware of that problem and will incorporate validation into the application. In the
meantime, I'll attempt to read up as much as I can about SqlParameter and SqlCommand.

Thanks for whatever you have time to offer...

Jeff
 
Hello Jeff,

Between doin your homework on sql injection attacks and reading the MSDN
doco on SqlParameter and SqlCommand.. you should be golden.

-Boo
 
Back
Top