|
-
Aug 19th, 2012, 07:50 PM
#4
Re: ID Module
There are reasons why you don't want to directly concatenate textbox contents into SQL strings. The most important one is that it leaves you open to SQL Injection attacks. That is why I showed the use of parameters, which is safer. I would also suggest that you use & rather than + for string concatenation. Both work, but there are cases where + will cause you trouble, unless you have Option Strict ON (which you should do anyways).
I'm not quite sure why you did it that way. You create a whole dataset for what should be a single row. Technically, that will work, but it is the slowest of all possible choices. You also name the table "0", which is a really unusual name, but does have a certain beauty to it, since Dataset.Tables(0) would return the same thing as Dataset.Tables("0"). I would suggest that giving the table a better name would make things easier in the long run. Not using a dataset and dataadapter at all would be better still. The only reason you are creating the dataset is to get a single value from a single row, if that single row exists. That is what the very fast ExecuteScalar is ideal for, which is why I used it in my example.
One other point is that you use SELECT *. You only want a single field, yet you are telling the DB to send back ALL the fields, whatever they are. Using * is inefficient, even if you want ALL the fields, though I would add that I sometimes use * anyways when I want all the fields, because it is much easier to type than typing out all the fields for a large table. In your case, you don't want all the fields, you want only a single field, so don't use *.
My usual boring signature: Nothing
 
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
Click Here to Expand Forum to Full Width
|