Use of the connectionstring from my web.config

[=?Utf-8?B?ZWdzZGFy?=]

Hello, I'd like to improve this code, because there's is a better way to use
the connectionstring from my web.config file instead of using:

Dim objConn As New
OleDbConnection("Provider=SQLNCLI;Server=db2fx981\ comware;Database=SIP;Trusted_Connection=yes;")

This is my code:

<%@ Import Namespace="System.Data" %>
<%@ Import Namespace="System.Data.OleDb" %>

<script runat="server">

Sub Page_Load(ByVal obj As Object, ByVal e As EventArgs)
Hidden1.Value = Request.QueryString("id")
If IsPostBack() Then
Dim objConn As New
OleDbConnection("Provider=SQLNCLI;Server=db2fx981\ comware;Database=SIP;Trusted_Connection=yes;")
objConn.Open()
Dim sSQL, Resul As String
sSQL = "Insert into Propuesta (idprospecto, Objeto, fecharecibo,
fechaentrega, idusuario, idestado ) values ('" & Hidden1.Value & "', '" &
TxtObjeto.Text & "', " & TxtFechaRecibo.Text & ", " & TxtFechaCierre.Text &
", '" & DropDownVendedor.SelectedValue & "', '" &
DropDownEstado.SelectedValue & "')"
Response.Write(sSQL)
'Response.End()
Dim objCmd As New OleDbCommand(sSQL, objConn)

Resul = objCmd.ExecuteNonQuery
If Resul Then
Label1.Visible = True
End If
End If
End Sub
</script>

Thx.

[Mark Rae [MVP]]

"egsdar" <eg****@discussions.microsoft.comwrote in message
news:9A**********************************@microsof t.com...

Hello, I'd like to improve this code, because there's is a better way to
use
the connectionstring from my web.config file instead of using:

Dim objConn As New
OleDbConnection("Provider=SQLNCLI;Server=db2fx981\ comware;Database=SIP;Trusted_Connection=yes;")

http://weblogs.asp.net/owscott/archi....net-v2.0.aspx
http://www.connectionstrings.com/?carrier=sqlserver2005

AAMOI, is there a reason that you're using the SQL Native Client instead of
the SQL Server .NET data provider?
http://forums.microsoft.com/TechNet/...0214&SiteID=17
--
Mark Rae
ASP.NET MVP
http://www.markrae.net

[=?Utf-8?B?ZWdzZGFy?=]

AAMOI, is there a reason that you're using the SQL Native Client instead of
the SQL Server .NET data provider?
Well, there's no reason at all, just i found that, do you have any
suggestions?

"Mark Rae [MVP]" wrote:

"egsdar" <eg****@discussions.microsoft.comwrote in message
news:9A**********************************@microsof t.com...

Hello, I'd like to improve this code, because there's is a better way to
use
the connectionstring from my web.config file instead of using:

Dim objConn As New
OleDbConnection("Provider=SQLNCLI;Server=db2fx981\ comware;Database=SIP;Trusted_Connection=yes;")

http://weblogs.asp.net/owscott/archi....net-v2.0.aspx
http://www.connectionstrings.com/?carrier=sqlserver2005

AAMOI, is there a reason that you're using the SQL Native Client instead of
the SQL Server .NET data provider?
http://forums.microsoft.com/TechNet/...0214&SiteID=17
--
Mark Rae
ASP.NET MVP
http://www.markrae.net

[Mark Rae [MVP]]

"egsdar" <eg****@discussions.microsoft.comwrote in message
news:3C**********************************@microsof t.com...

>AAMOI, is there a reason that you're using the SQL Native Client instead
of
the SQL Server .NET data provider?

Well, there's no reason at all, just I found that, do you have any
suggestions?

Yes - use the SQL .NET data provider so that you can use SqlClient instead
of OleDb...
--
Mark Rae
ASP.NET MVP
http://www.markrae.net

[=?Utf-8?B?YnJ1Y2UgYmFya2Vy?=]

there is a <connectionStringssection in the web.config. add one for your
database then:

var s = ConfigurationManager.ConnectionStrings["myConn"].ConnectionString;

also you should read about sql injection because your code has this huge
security hole.

-- bruce (sqlwork.com)
"egsdar" wrote:

Hello, I'd like to improve this code, because there's is a better way to use
the connectionstring from my web.config file instead of using:

Dim objConn As New
OleDbConnection("Provider=SQLNCLI;Server=db2fx981\ comware;Database=SIP;Trusted_Connection=yes;")

This is my code:

<%@ Import Namespace="System.Data" %>
<%@ Import Namespace="System.Data.OleDb" %>

<script runat="server">

Sub Page_Load(ByVal obj As Object, ByVal e As EventArgs)
Hidden1.Value = Request.QueryString("id")
If IsPostBack() Then
Dim objConn As New
OleDbConnection("Provider=SQLNCLI;Server=db2fx981\ comware;Database=SIP;Trusted_Connection=yes;")
objConn.Open()
Dim sSQL, Resul As String
sSQL = "Insert into Propuesta (idprospecto, Objeto, fecharecibo,
fechaentrega, idusuario, idestado ) values ('" & Hidden1.Value & "', '" &
TxtObjeto.Text & "', " & TxtFechaRecibo.Text & ", " & TxtFechaCierre.Text &
", '" & DropDownVendedor.SelectedValue & "', '" &
DropDownEstado.SelectedValue & "')"
Response.Write(sSQL)
'Response.End()
Dim objCmd As New OleDbCommand(sSQL, objConn)

Resul = objCmd.ExecuteNonQuery
If Resul Then
Label1.Visible = True
End If
End If
End Sub
</script>

Thx.

[sloan]

http://www.connectionstrings.com/?carrier=sqlserver2005

SqlConnection (.NET)

"egsdar" <eg****@discussions.microsoft.comwrote in message
news:3C**********************************@microsof t.com...

AAMOI, is there a reason that you're using the SQL Native Client instead
of
the SQL Server .NET data provider?
Well, there's no reason at all, just i found that, do you have any
suggestions?

"Mark Rae [MVP]" wrote:

>"egsdar" <eg****@discussions.microsoft.comwrote in message
news:9A**********************************@microso ft.com...

Hello, I'd like to improve this code, because there's is a better way
to
use
the connectionstring from my web.config file instead of using:

Dim objConn As New
OleDbConnection("Provider=SQLNCLI;Server=db2fx981\ comware;Database=SIP;Trusted_Connection=yes;")

http://weblogs.asp.net/owscott/archi....net-v2.0.aspx
http://www.connectionstrings.com/?carrier=sqlserver2005

AAMOI, is there a reason that you're using the SQL Native Client instead
of
the SQL Server .NET data provider?
http://forums.microsoft.com/TechNet/...0214&SiteID=17
--
Mark Rae
ASP.NET MVP
http://www.markrae.net

[Mark Rae [MVP]]

"egsdar" <eg****@discussions.microsoft.comwrote in message
news:1D**********************************@microsof t.com...

Thanks all for your support, but unfortunately after the changes I'm
receiving
this error message:

Keyword not supported: 'provider'.

As previously advised, use SqlClient rather than SQLNCLI...

<connectionStrings>
<add name="SIPConnectionString" connectionString="Data
Source=MyServer;Initial Catalog=MyDatabase;Integrated Security=SSPI;"
providerName="System.Data.SqlClient"/>
</connectionStrings>

<%@ Import Namespace="System.Data.OleDb" %>

<%@ Import Namespace="System.Data.SqlClient" %>

Dim objConn As New
OleDbConnection(ConfigurationManager.ConnectionStr ings("SIPConnectionString").ConnectionString)

Dim objConn As New
SqlConnection(ConfigurationManager.ConnectionStrin gs("SIPConnectionString").ConnectionString)

Dim objCmd As New OleDbCommand(sSQL, objConn)

Dim objCmd As New SqlCommand(sSQL, objConn)

Also, as mentioned by another poster, your code is wide open to SQL
Injection. Whatever you do, do not deploy this on a public webserver until
you've fixed that...
--
Mark Rae
ASP.NET MVP
http://www.markrae.net