Click here to Skip to main content
16,022,333 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
VB
Sub AddTOCart()
     Try
         If txtQuantity.Text = String.Empty Or txtQuantity.Text = "0" Then Return
         Dim CartDate As String = Now.ToString("yyyy/MM/dd")
         cn.Open()
         cm = New SqlCommand("insert into tblCart (CartInvoice,CartProduct,CartPrice,CartQuantity,CartDate,CartUser)values(@CartInvoice,@CartProduct,@CartPrice,@CartQuantity,@CartDate,@CartUser)", cn)
         With FormSales
             cm.Parameters.AddWithValue("CartInvoice", .lblInvoice.Text)
             cm.Parameters.AddWithValue("CartProduct", lblPID.Text)
             cm.Parameters.AddWithValue("CartPrice", CDbl(LblPrice.Text))
             cm.Parameters.AddWithValue("CartQuantity", CInt(txtQuantity.Text))
             cm.Parameters.AddWithValue("CartDate", CartDate)
             cm.Parameters.AddWithValue("CartUser", StrUser)
             cm.ExecuteNonQuery()
             cn.Close()
             cn.Open()
             cm = New SqlCommand("update tblCart set CartTotal = CartPrice * CartQuantity where CartInvoice like '" & .lblInvoice.Text & "'", cn)
             cm.ExecuteNonQuery()
             cn.Close()
             .txtSearch.Focus()
             .txtSearch.SelectionStart = 0
             .txtSearch.SelectionLength = .txtSearch.Text.Length
             .LoadCart()
         End With
         Me.Dispose()
     Catch ex As Exception
         cn.Close()
         MsgBox(ex.Message, vbCritical)
     End Try
 End Sub
*******
Sub LoadCart()
    Try
        Dim i As Integer = 0
        Dim total As Double = 0
        DataGridView1.Rows.Clear()
        cn.Open()
        cm = New SqlCommand("SELECT * FROM tblCart AS r INNER JOIN tblProduct AS p ON r.CartProduct = ProductID INNER JOIN tblGeneric AS g ON p.ProductGeneric = GenericID INNER JOIN tblBrand AS b ON p.ProductBrand = BrandID INNER JOIN tblFromulation AS f ON p.ProductFromulation = FromulationID INNER JOIN tblClassification AS c ON p.ProductClassification = ClassificationID INNER JOIN tblType AS t ON p.ProductType = TypeID where CartInvoice like '" & lblInvoice.Text & "'", cn)
        dr = cm.ExecuteReader
        With dr.Read
            i += 1
            DataGridView1.Rows.Add(i, dr.Item("CartID").ToString, dr.Item("CartInvoice").ToString, dr.Item("GenericName").ToString, dr.Item("BrandName").ToString, dr.Item("FromulationName").ToString, dr.Item("ClassificationName").ToString, dr.Item("TypeName").ToString, dr.Item("ProductSalePrice").ToString, dr.Item("CartQuantity").ToString, Format(CDate(dr.Item("ProductDate").ToString), "yyyy/MM"), dr.Item("CartTotal").ToString)
            total += CDbl(dr.Item("CartTotal").ToString)
        End With
        dr.Close()
        cn.Close()
        lblDisplayTotal.Text = Format(total, "#,##0")
    Catch ex As Exception
        cn.Close()
        MsgBox(ex.Message, vbCritical)
    End Try
End Sub


What I have tried:

VB
DataGridView1.Rows.Add(i, dr.Item("ProductID").ToString
Posted
Updated 8-Jul-24 14:19pm
v3
Comments
Dave Kreskowiak 8-Jul-24 19:11pm    
OK, and? You haven't described a problem with any useful detail at all.
What does the code do? What is it expected to do? What is it actually doing? Any error messages? ...

1 solution

Don't do it like that!
Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
SQL
DROP TABLE MyTable;
A perfectly valid "delete the table" command
SQL
--'
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900