0

I am using the below code to grab the page tiles, meta description from database created in SQL Server 2005. My site is built with ASP.NET 2.0 and C#.

On page_load I am executing this code:

string query = "select MetaDescription, MetaKeywords, H1Text, Ptitle, H2Text FROM SeoText Where CatalogItemId ='" + this.CurrentEnsemble.ItemId + "'";

SqlConnection myconnection = new SqlConnection(ConfigurationManager.ConnectionStrings["DBconnection"].ConnectionString);

SqlCommand SqlCmd = null;
SqlCmd = new SqlCommand(query, myconnection);

SqlDataAdapter ad = new SqlDataAdapter(SqlCmd);

DataTable dt = new DataTable();
ad.Fill(dt);

if (dt.Rows[0]["Ptitle"].ToString() == "")
{
   this.Page.Title = this.CurrentEnsemble.Title;
}
else
{
   this.Page.Title = this.CurrentEnsemble.Title + " " + dt.Rows[0]["Ptitle"].ToString();
}

HtmlMeta metaDesc = (HtmlMeta)Page.Header.FindControl("metaDesc");

if (dt.Rows[0]["MetaDescription"].ToString() == "")
{
   metaDesc.Attributes.Add("Content", this.CurrentEnsemble.Title );
}
else
{
   metaDesc.Attributes.Add("Content", dt.Rows[0]["MetaDescription"].ToString());
}

HtmlMeta metaKey = (HtmlMeta)Page.Header.FindControl("metaKey");

if (dt.Rows[0]["MetaKeywords"].ToString() == "")
{
   metaKey.Attributes.Add("Content", "site general text");
}
else
{
   metaKey.Attributes.Add("Content", dt.Rows[0]["MetaKeywords"].ToString());
}

HtmlGenericControl h1 = (HtmlGenericControl)Master.Master.Master.FindControl("h1top");

if (dt.Rows[0]["H1Text"].ToString() == "")
{
    h1.InnerText = "site general text";
}
else
{
    h1.InnerText = this.CurrentEnsemble.Title + " " + dt.Rows[0]["H1Text"].ToString();
}

HtmlGenericControl h2 = (HtmlGenericControl)Master.Master.Master.FindControl("h2bottom");

if (dt.Rows[0]["H2Text"].ToString() == "")
{
    h2.InnerText = "site general text";
}
else
{
    h2.InnerText = this.CurrentEnsemble.Title + " " + dt.Rows[0]["H2Text"].ToString();
}

The error is thrown at 

ad.Fill(dt)

I am not sure where I am making the mistake.

Thanks and appreciate it

marc_s
  • 732,580
  • 175
  • 1,330
  • 1,459
niceoneishere
  • 343
  • 2
  • 10
  • 25
  • **warning** your code is vulnerable to sql injection attacks. – Daniel A. White Oct 24 '12 at 15:51
  • Thanks Daniel for replying, if you are talking about select query where clause, I understand that its prone to SQL Injection if the user is entering any value into it, THIS one is just used in the code behind and no one enters anything into it, All its doing is grabbing the Ensemble Item Id like product id from the database checking it against this table itemid. MY major issue is, its throwing an timeout on sqldatadapter.fill. I am letting the sqldataadapter handle the open and close connection too, so its not like I am not closing the connection, VERY wired as this happens on a random basis. – niceoneishere Oct 24 '12 at 20:12

1 Answers1

0

Try adding with (nolock) statements to your statment. Similar problem here: SqlDataAdapter.Fill() Timeout - Underlying Sproc Returns Quickly

Community
  • 1
  • 1
Ademar
  • 5,657
  • 1
  • 17
  • 23