0

I've come across this before but I don't recall how I handled it.

Building a website with ASP/VB.NET 4.0, accessing a MSSQL v.2005 database, populating a gridview. This webpage worked fine until I added code to process parameters in the URL: .../ETL_S_EXPORT_MM002.aspx?VEN=74&ALL=y

The page only showed * from the view before, but now it insists that Vendor_Name_1 doesn't exist. If I comment all references to that out, it insists that Vendor_Name_2 doesn't exist. I am at my wits' end, someone please save me...

SQL Data source:

<asp:SqlDataSource ID="SqlDataSource1" runat="server" 
    ConnectionString="<%$ ConnectionStrings:ERPConnectionString %>" 
    SelectCommand="SELECT Vendor_Number
                        , Vendor_Name_1
                        , Vendor_Name_2
                        , ETLID
                        , remits_Seq 
                     FROM [dbo].[...]" >
</asp:SqlDataSource>

Gridview:

<asp:GridView ID="GridView1" 
    runat="server" 
    AllowPaging="True" 
    PageSize="200"
    AllowSorting="True" 
    AutoGenerateColumns="False" 
    GridLines="Vertical"
    DataSourceID="SqlDataSource1" 
    CellPadding="4"
    CssClass="gridviewPageGRID">
    <AlternatingRowStyle CssClass="gridviewAlternatingRowStyleGRID"/>
    <Columns>
        <asp:TemplateField HeaderText="Vendor Number"  SortExpression="Vendor_Number">
            <ItemTemplate>
                <div style="width:120px; text-align:center;">
                    <asp:Label ID="l2" runat="server" Text='<%# Eval("Vendor_Number")%>'/>
                </div>
            </ItemTemplate>
        </asp:TemplateField>
        <asp:HyperLinkField 
            DataTextField="remits_Seq"
            HeaderText="Remit Sequence"
            SortExpression="remits_Seq"
            ItemStyle-HorizontalAlign="Center"
            DataNavigateUrlFields="remits_Seq, Vendor_Number" 
            DataNavigateUrlFormatString ="ETL_S_EXPORT_MM002_ONE.aspx?RS={0}&VN={1}">
            <ItemStyle HorizontalAlign="Center"></ItemStyle>
        </asp:HyperLinkField>
        <asp:BoundField DataField="Vendor_Name_1"   HeaderText="Vendor Name 1" SortExpression="Vendor_Name_1" />
        <asp:BoundField DataField="Vendor_Name_2"   HeaderText="Vendor Name 2" SortExpression="Vendor_Name_2" />
    </Columns>
</asp:GridView>

Code behind to add "where" statements to query, if needed (db is an object that takes care of building the where statement):

Dim flag As String = Request.QueryString("ALL")
Dim db As New classDashBoard
db.ObjectKey = "MM002"
db.parmVNA = Request.QueryString("VNA")
db.parmVEN = Request.QueryString("VEN")
db.selectFilterParm()
If flag = "n" Then
    If db.Filter = "" Then
        If db.parmVNA <> "" Then db.Filter = "Vendor_Name_1 LIKE '%" & db.parmVNA & "%'"
    Else
        If db.parmVNA <> "" Then db.Filter &= " OR Vendor_Name_1 LIKE '%" & db.parmVNA & "%'"
    End If
    If db.Filter = "" Then
        If db.parmVEN <> "" Then db.Filter = "Vendor_Number LIKE '%" & db.parmVEN & "%'"
    Else
        If db.parmVEN <> "" Then db.Filter &= " OR Vendor_Number LIKE '%" & db.parmVEN & "%'"
    End If
ElseIf flag = "y" Then
    If db.Filter = "" Then
        If db.parmVNA <> "" Then db.Filter = "Vendor_Name_1 LIKE '%" & db.parmVNA & "%'"
    Else
        If db.parmVNA <> "" Then db.Filter &= " AND Vendor_Name_1 LIKE '%" & db.parmVNA & "%'"
    End If
    If db.Filter = "" Then
        If db.parmVEN <> "" Then db.Filter = "Vendor_Number LIKE '%" & db.parmVEN & "%'"
    Else
        If db.parmVEN <> "" Then db.Filter &= " AND Vendor_Number LIKE '%" & db.parmVEN & "%'"
    End If
  End If
db.countAllRecords()
db.countSomeRecords()
db.buildCountsHeader()
db.buildCountsSQL()
'   ----------------------
'   Add header to the page
'   ----------------------
Panel1.Controls.Add(New LiteralControl(db.counts_header))
'   -------------------------------------
'   Adjust the SQL according to the Parms
'   -------------------------------------
Me.SqlDataSource1.SelectCommand = db.counts_SQL

The view:

SELECT COALESCE (m.Vendor_Number, '') AS Vendor_Number
     , COALESCE (m.Vendor_Name_1, '') AS Vendor_Name_1
     , COALESCE (m.Vendor_Name_2, '') AS Vendor_Name_2
     , COALESCE (m.remits_Seq   , '') AS remits_Seq
     , COALESCE (m.ETLID        , '') AS ETLID
  FROM....

As you can see, all rows exist in the view.

Thank you all for your time. Let me know of any questions I can answer.

3-31-2014 Can anyone help?

pixelmeow
  • 654
  • 1
  • 9
  • 31
  • [Good luck](http://stackoverflow.com/questions/332365/how-does-the-sql-injection-from-the-bobby-tables-xkcd-comic-work) – Steve Mar 24 '14 at 18:36
  • What Steve is trying to say is that your code is totally vulnerable to SQL injection. You should never concatenate data from a user into your SQL queries. – Sami Kuhmonen Mar 24 '14 at 19:25
  • Ah, I see. Do you have a suggestion for how I can learn to do this differently? BTW, this is an internal website, totally cut off from the outside world. :) Any idea about the other part? – pixelmeow Mar 24 '14 at 19:30

0 Answers0