Check blank fields with VB.NET

Question

1.00/5 (1 vote)

See more:

How do I prevent a user from leaving a blank cell in GroupBox1
Note that the form name is Data_Entery

What I have tried:

I tried this code and it didn't work:

VB

For Each item As Data_Entery In GroupBox1.Controls
           
            If item.Text = Nothing Then
                

                MsgBox("يرجى تعبئة جميع البيانات")
                cmM_H.Focus()
                Exit Sub
            Else

                If MsgBox("هل تريد حفظ البيانات", MsgBoxStyle.OkCancel) = MsgBoxResult.Ok Then
                    Dim cmd As New OleDbCommand
                    cmd = New OleDbCommand("Insert Into Data_Entrey ([M_H],[MR_MS],[T_G],[Modil],[Compeny],[Many_Factor],[SN],[NO],[Date],[GH_DE],[Po],[Notes]) values ('" & TextBox1.Text & "','" & TextBox2.Text & "','" & TextBox3.Text & "','" & TextBox4.Text & "','" & TextBox5.Text & "','" & TextBox6.Text & "','" & TextBox7.Text & "','" & TextBox8.Text & "', #" & DateTimePicker1.Text & "# ,'" & TextBox9.Text & "','" & TextBox10.Text & "','" & TextBox11.Text & "')", con)
                    con.Open()
                    cmd.ExecuteNonQuery()
                    con.Close()
                    btnSave.Enabled = False
                    btnNew.Enabled = True
                    GroupBox1.Enabled = False
                    Button1.Focus()

                End If
            End If
        Next

Posted 20-Jan-21 5:17am

Ali198324

Updated 20-Jan-21 6:00am

Maciej Los

v2

Add a Solution

Comments

[no name] 20-Jan-21 11:23am

It is a really bad idea to pass unvalidated code direct into your SQL statement via string concatenation. It is a great way to get your database destroyed by malicious users. Also, your second messagebox call does not check that all information has been correctly entered.

Ali198324 20-Jan-21 11:56am

Why did this code not work?

Private Sub btnSave_Click_1(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnSave.Click
For Each item As Data_Entery In GroupBox1.Controls
If String.IsNullOrEmpty(item.Text) Then
''inform the user that all fields should have a value
MsgBox("Please fill up all fields............." & item.Name)
item.Focus()
Exit Sub
End If
Next
If MsgBox("Do you want to save this record?", MsgBoxStyle.OkCancel) = MsgBoxResult.Ok Then
''save the record
End If
End Sub

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

OriginalGriff · Answer 1 · 2021-01-20T05:25:00

You can use the String.IsNullOrWhiteSpace(String) Method (System) | Microsoft Docs[^]

But ... don't do it like that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'

The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'

Which SQL sees as three separate commands:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'x';

A perfectly valid SELECT

SQL

DROP TABLE MyTable;

A perfectly valid "delete the table" command

SQL

--'

And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

BTW: Do yourself a favour, and stop using Visual Studio default names for everything - you may remember that "TextBox8" is the mobile number today, but when you have to modify it in three weeks time, will you then? Use descriptive names - "tbMobileNo" for example - and your code becomes easier to read, more self documenting, easier to maintain - and surprisingly quicker to code because Intellisense can get to to "tbMobile" in three keystrokes, where "TextBox8" takes thinking about and 8 keystrokes...
At least 11 TextBoxes on one form, and you leave all the names as default? That's going to lead to errors later that will corrupt your DB and be very painful to fix.