fixing multi line text before saving to dbase

[Daves]

I am saving to database a result from multi-line textbox. The database of
course wants \x escape codes, not the invisible ones. Is there any easy -
one line code - way to do this (c#) eg by String.Format() ?

[Patrice]

"The database" or a dynamically created SQL statement ?

Using String.Replace should do but you could use parameters instead... IMO
the problem is that you are creating a dynamic SQL string. If you use
parametized queries you shouldn't have this problem (as line feeds will not
be part of the "SQL statement" but will just be included inside the
parameter value).

Patrice

--

"Daves" <db****@simnet. is> a écrit dans le message de
news:uP******** ******@tk2msftn gp13.phx.gbl...

I am saving to database a result from multi-line textbox. The database of
course wants \x escape codes, not the invisible ones. Is there any easy -
one line code - way to do this (c#) eg by String.Format() ?

[Daves]

umm not sure what you mean but it goes like

string ContentString = Textbox1.Text;

.... here I could do some ContentString.R eplace() functions but I thought
maybe there would be a simple one line to do the job eg. String.Format() ?
....

SQLString = "UPDATE Content='" + ContentString + "'" WHERE ...";
myCommand = new OleDbCommand(SQ LSave, myConnection);
myCommand.Execu teNonQuery();


"Patrice" <no****@nowhere .com> wrote in message
news:%2******** ********@tk2msf tngp13.phx.gbl. ..

"The database" or a dynamically created SQL statement ?

Using String.Replace should do but you could use parameters instead... IMO
the problem is that you are creating a dynamic SQL string. If you use
parametized queries you shouldn't have this problem (as line feeds will
not
be part of the "SQL statement" but will just be included inside the
parameter value).

Patrice

--

"Daves" <db****@simnet. is> a écrit dans le message de
news:uP******** ******@tk2msftn gp13.phx.gbl...

I am saving to database a result from multi-line textbox. The database of
course wants \x escape codes, not the invisible ones. Is there any easy -
one line code - way to do this (c#) eg by String.Format() ?

[jasonkester]

Daves wrote:

... here I could do some ContentString.R eplace() functions but I thought maybe there would be a simple one line to do the job eg. String.Format() ? ...

SQLString = "UPDATE Content='" + ContentString + "'" WHERE ...";
myCommand = new OleDbCommand(SQ LSave, myConnection);
myCommand.Execu teNonQuery();

As Patrice mentioned, you are having problems because you are ignoring
some Best Practices for building applications in .NET. Ideally you
should be using stored procedures:

myCommand = new SqlCommand("sp_ ContentUpdate", myConnection);
myCommand.Param eters.Add("@Con tentString", contentString);
myCommand.Execu teNonQuery();

Ad hoc SQL in your code is a Bad Thing. If you absolutely must use it,
you should at least use parameterized sql:

SQLString = "UPDATE Content set ContentString = @ContentString WHERE
....";
myCommand = new SqlCommand(SQLS tring , myConnection);
myCommand.Param eters.Add("@Con tentString", contentString);
myCommand.Execu teNonQuery();

No more formatting your strings off the page, no more SQL Injection
attacks against your site. Check out
http://www.uberasp.net/getarticle.aspx?id=46 for more info.

Good Luck!
Jason
http://www.expatsoftware.com/

[Daves]

very interesting, I didn't know this! Does this mean I should also used SP
queries when not using fixed queries that is no data from a form?
"jasonkeste r" <ja*********@gm ail.com> wrote in message
news:11******** **************@ g14g2000cwa.goo glegroups.com.. .

Daves wrote:

... here I could do some ContentString.R eplace() functions but I

thought

maybe there would be a simple one line to do the job eg.

String.Format() ?

...

SQLString = "UPDATE Content='" + ContentString + "'" WHERE ...";
myCommand = new OleDbCommand(SQ LSave, myConnection);
myCommand.Execu teNonQuery();

As Patrice mentioned, you are having problems because you are ignoring
some Best Practices for building applications in .NET. Ideally you
should be using stored procedures:

myCommand = new SqlCommand("sp_ ContentUpdate", myConnection);
myCommand.Param eters.Add("@Con tentString", contentString);
myCommand.Execu teNonQuery();

Ad hoc SQL in your code is a Bad Thing. If you absolutely must use it,
you should at least use parameterized sql:

SQLString = "UPDATE Content set ContentString = @ContentString WHERE
...";
myCommand = new SqlCommand(SQLS tring , myConnection);
myCommand.Param eters.Add("@Con tentString", contentString);
myCommand.Execu teNonQuery();

No more formatting your strings off the page, no more SQL Injection
attacks against your site. Check out
http://www.uberasp.net/getarticle.aspx?id=46 for more info.

Good Luck!
Jason
http://www.expatsoftware.com/