I want to show Components in a tabs , so first of all create few components. In this project we have three components, First View Component public class AllViewComponent : ViewComponent { private readonly UserManager<ApplicationUser> _userManager; public AllViewComponent(UserManager<ApplicationUser> userManager) { _userManager = userManager; } public async Task<IViewComponentResult> InvokeAsync() { List<StudentViewModel> allUsers = new List<StudentViewModel>(); var items = await _userManager.Users.ToListAsync(); foreach (var item in items) { allUsers.Add(new StudentViewModel {Id=item.Id, EnrollmentNo = item.EnrollmentNo, FatherName = item.FatherName, Name = item.Name, Age = item.Age, Birthdate = item.Birthdate, Address = item.Address, Gender = item.Gender, Email = item.Email }); }
In myPrevious article, we have already learn about SQL injection attack. We saw that if we use Text Box for retrieving data from the database then other queries also perform with the same database. So, Microsoft provide, Parameterized query for DML and DQL statements. Like
Replace this statement with the parameterized query
Direct Interface with TextBox (SQL Injection Attack Possible)
cmd.CommandText = "Select * from [TableName] where name='"+TextBox1.Text+"'";
Resolve this problem by the parameterized query
cmd.CommandText = "Select * from [TableName] where name=@name1";
cmd.Parameter.AddWithValue("@name1",TextBox1.Text);
Replace this statement with the parameterized query
Direct Interface with TextBox (SQL Injection Attack Possible)
cmd.CommandText = "Select * from [TableName] where name='"+TextBox1.Text+"'";
Resolve this problem by the parameterized query
cmd.CommandText = "Select * from [TableName] where name=@name1";
cmd.Parameter.AddWithValue("@name1",TextBox1.Text);
Comments
Post a Comment