Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Code Project
  1. Home
  2. General Programming
  3. C#
  4. How to save values in table in SQL without crashing when it is used by multiple users

How to save values in table in SQL without crashing when it is used by multiple users

Scheduled Pinned Locked Moved C#
questioncsharpdatabasesysadminsales
21 Posts 7 Posters 0 Views 1 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • Richard DeemingR Richard Deeming

    It looks like you're part-way through rewriting your code to avoid SQL Injection. :thumbsup: As a result, you can remove all of the code that's building up the sdata string, since it's no longer used. The lines which call cfs.get_data are still vulnerable, and need to be rewritten to use parameters. You need to remove the calls to cfs.singlequotconver. Based on the name, it's trying to avoid SQL Injection by "escaping" quote characters. Since you're now using parameters, you don't need to do that. You should also remove the call to cfs.sqldateconverion, which is probably converting the date to a string. Dates should be passed and stored as dates.


    "These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer

    T Offline
    T Offline
    TarunKumarSusarapu
    wrote on last edited by
    #12

    Thank you Mr.Ricard.These may be one of the reasons of data crashing.I will try to do modifications at my side and let you know the concerns about this.

    1 Reply Last reply
    0
    • L Lost User
      1. You're probably updating way more fields than the "business rule" requires; possibly fouling up foreign keys in the process. 2) Maybe a "Delete and insert" makes more sense than an "update" here. 3) It seems you're arbitrarily overwriting everything. You will probably have better success if you incorporate "versioning"; which will also make your "WHERE" clauses more intelligent instead of blindly accessing by line# only. That, and a transaction.

      "(I) am amazed to see myself here rather than there ... now rather than then". ― Blaise Pascal

      T Offline
      T Offline
      TarunKumarSusarapu
      wrote on last edited by
      #13

      Thank you Mr.Gerry.These may be one of the reasons of data crashing.Can u please explain the point 3 briefly and give me ways to write short code for that.

      L 1 Reply Last reply
      0
      • Richard DeemingR Richard Deeming

        It looks like you're part-way through rewriting your code to avoid SQL Injection. :thumbsup: As a result, you can remove all of the code that's building up the sdata string, since it's no longer used. The lines which call cfs.get_data are still vulnerable, and need to be rewritten to use parameters. You need to remove the calls to cfs.singlequotconver. Based on the name, it's trying to avoid SQL Injection by "escaping" quote characters. Since you're now using parameters, you don't need to do that. You should also remove the call to cfs.sqldateconverion, which is probably converting the date to a string. Dates should be passed and stored as dates.


        "These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer

        T Offline
        T Offline
        TarunKumarSusarapu
        wrote on last edited by
        #14

        Here Passing a query as a parameter to get_data method.How can we use parameters here?

        public string get_data(string sqlstr)
        {
        string strTemp = "";
        try
        {
        double sum = 0;
        if (cn.State != ConnectionState.Open) cn.Open();
        TRcmd2.Connection = cn;
        TRcmd2.CommandText = sqlstr;
        TRdr = TRcmd2.ExecuteReader();
        if (TRdr.Read())
        strTemp = TRdr.GetValue(0).ToString();
        TRdr.Close();
        }
        catch
        {
        try
        {
        if (!TRdr.IsClosed == true) TRdr.Close();
        }
        catch (Exception EX) { }
        }
        return (strTemp);
        }

        Richard DeemingR 1 Reply Last reply
        0
        • T TarunKumarSusarapu

          Thank you Mr.Gerry.These may be one of the reasons of data crashing.Can u please explain the point 3 briefly and give me ways to write short code for that.

          L Offline
          L Offline
          Lost User
          wrote on last edited by
          #15

          [rowversion (Transact-SQL)](https://msdn.microsoft.com/en-us/library/ms182776.aspx)

          "(I) am amazed to see myself here rather than there ... now rather than then". ― Blaise Pascal

          T 1 Reply Last reply
          0
          • Richard DeemingR Richard Deeming

            It looks like you're part-way through rewriting your code to avoid SQL Injection. :thumbsup: As a result, you can remove all of the code that's building up the sdata string, since it's no longer used. The lines which call cfs.get_data are still vulnerable, and need to be rewritten to use parameters. You need to remove the calls to cfs.singlequotconver. Based on the name, it's trying to avoid SQL Injection by "escaping" quote characters. Since you're now using parameters, you don't need to do that. You should also remove the call to cfs.sqldateconverion, which is probably converting the date to a string. Dates should be passed and stored as dates.


            "These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer

            T Offline
            T Offline
            TarunKumarSusarapu
            wrote on last edited by
            #16

            I tried all the points as you mentioned here.But still, invoice number clash happens when the multiple users save at a time.Here the invoice number is unique.But in details part we can save multiple products for a particular invoice.But here clash happens when multiple users enter data at once. for example

            users-->invoice no Products
            Raj 1 J,K
            Tarun 2 O,M

            But at the time of saving it swapped like this

            users-->invoice no Products
            Raj 1 J,K,M-------->Clashing taken place
            Tarun 2 O

            Please give me suggestions to solve this.

            1 Reply Last reply
            0
            • L Lost User

              [rowversion (Transact-SQL)](https://msdn.microsoft.com/en-us/library/ms182776.aspx)

              "(I) am amazed to see myself here rather than there ... now rather than then". ― Blaise Pascal

              T Offline
              T Offline
              TarunKumarSusarapu
              wrote on last edited by
              #17

              I tried all the points as you mentioned here.But still, invoice number clash happens when the multiple users save at a time.Here the invoice number is unique.But in details part we can save multiple products for a particular invoice.But here clash happens when multiple users enter data at once. for example

              users-->invoice no Products
              Raj 1 J,K
              Tarun 2 O,M

              But at the time of saving it swapped like this

              users-->invoice no Products
              Raj 1 J,K,M-------->Clashing taken place
              Tarun 2 O

              Please give me suggestions to solve this.

              L 1 Reply Last reply
              0
              • T TarunKumarSusarapu

                Here Passing a query as a parameter to get_data method.How can we use parameters here?

                public string get_data(string sqlstr)
                {
                string strTemp = "";
                try
                {
                double sum = 0;
                if (cn.State != ConnectionState.Open) cn.Open();
                TRcmd2.Connection = cn;
                TRcmd2.CommandText = sqlstr;
                TRdr = TRcmd2.ExecuteReader();
                if (TRdr.Read())
                strTemp = TRdr.GetValue(0).ToString();
                TRdr.Close();
                }
                catch
                {
                try
                {
                if (!TRdr.IsClosed == true) TRdr.Close();
                }
                catch (Exception EX) { }
                }
                return (strTemp);
                }

                Richard DeemingR Offline
                Richard DeemingR Offline
                Richard Deeming
                wrote on last edited by
                #18

                For a start, don't store connection and command objects in fields. Instead, create them when you need them, and wrap them in a using block to ensure that they're always disposed of properly. You don't need to call ExecuteReader to get the value of the first column of the first row; use ExecuteScalar[^] instead. And you need to add a params parameter[^] to your method to pass parameters:

                private static void PrepareCommand(SqlCommand command, string commandText, object[] parameters)
                {
                if (parameters != null && parameters.Length != 0)
                {
                string[] parameterNames = new string[parameters.Length];
                for (int index = 0; index < parameters.Length; index++)
                {
                string name = "@p" + index;
                parameterNames[index] = name;
                command.Parameters.AddWithValue(name, parameters[index]);
                }

                    commandText = string.Format(commandText, parameterNames);
                }
                
                command.CommandText = commandText;
                

                }

                public string get_data(string commandText, params object[] parameters)
                {
                using (var connection = new SqlConnection(ConnectionString))
                using (var command = new SqlCommand(string.Empty, connection))
                {
                PrepareCommand(command, commandText, parameters);

                    connection.Open();
                    object result = command.ExecuteScalar();
                    return Convert.ToString(result);
                }
                

                }

                You can then pass parameters to the command using the auto-generated names:

                cfs.get_data("select top 1 AVERAGE_COST from PRODUCT where PRODUCT_NO = @p0", strpcode)

                or by position:

                cfs.get_data("select top 1 AVERAGE_COST from PRODUCT where PRODUCT_NO = {0}", strpcode)


                "These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer

                "These people looked deep within my soul and assigned me a number based on the order in which I joined" - Homer

                1 Reply Last reply
                0
                • T TarunKumarSusarapu

                  I tried all the points as you mentioned here.But still, invoice number clash happens when the multiple users save at a time.Here the invoice number is unique.But in details part we can save multiple products for a particular invoice.But here clash happens when multiple users enter data at once. for example

                  users-->invoice no Products
                  Raj 1 J,K
                  Tarun 2 O,M

                  But at the time of saving it swapped like this

                  users-->invoice no Products
                  Raj 1 J,K,M-------->Clashing taken place
                  Tarun 2 O

                  Please give me suggestions to solve this.

                  L Offline
                  L Offline
                  Lost User
                  wrote on last edited by
                  #19

                  Where's the version number? I don't see any evidence of you "trying all the points".

                  "(I) am amazed to see myself here rather than there ... now rather than then". ― Blaise Pascal

                  1 Reply Last reply
                  0
                  • T TarunKumarSusarapu

                    How to save values in SQL in two different columns in a table without crashing of the values in a network.

                    Ex: There are 20 users in my network.All wants to update one particular row at a time.
                    Here the crashing has been taken place.That means suppose I have taken one table in that many columns there.The user wants to update two columns a,b with their values at a time. when we click on update sometimes it swaps the data.

                    a=10,
                    b=20 i want to update

                    but it updated like this a=20,b=10
                    sometimes it has been taken null value also.
                    Why does it happen?

                    If you explain how to solve this problem.It would be appreciated.

                    I have written this code in c# to save.But while users saving at a time one row.The swapping of column values saving taken place.

                    sqlstr = "Insert into invINVOICEDETAILS (comment_NAME30, PRODUCT_NO, PRODUCT_NAME, QTY, UOM, PRICE, ITEM1_NO, DISCOUNT_PC, AMOUNT, SC_NO, GL_CODE, PROJ_NO, Gp_NO, WH_NO, Sales_exempt,FACTOR," +
                    "Category, IMPORTED_FROM_NO, IMPORTED_FROM, GST_Amt, DISCOUNT_PC_2,Ref_No, GL_DESC, PRODUCT_NAME_LONG, CREATED_BY," +
                    "DATE_CREATED, Deleted, INV_NO,Transfer, TICK, ID, AC_NO, AC_NAME, ITEM10, invNo_user, AVERAGE_COST, LP_COST, STD_COST,QTY_UNFILLED,DATETIME,Batch_No," +
                    "Expiry_Date,PRINT_ITEM,QTY_BILLED,ITEM6_NO,ITEM7_NO,ITEM8_NO,IMPORT_KEY) values (@comment_NAME30,@PRODUCT_NO,@PRODUCT_NAME,@QTY,@UOM,@PRICE," +
                    "@ITEM1_NO,@DISCOUNT_PC,@AMOUNT,@SC_NO,@GL_CODE,@PROJ_NO,@Gp_NO," +
                    "@WH_NO,@Sales_exempt,@FACTOR,@Category,@IMPORTED_FROM_NO," +
                    "@IMPORTED_FROM,@GST_Amt,@DISCOUNT_PC_2,@Ref_No,@GL_DESC," +
                    "@PRODUCT_NAME_LONG, @CREATED_BY, @DATE_CREATED, @Deleted, @INV_NO," +
                    "@Transfer,@TICK,@ID,@AC_NO,@AC_NAME,@ITEM10,@invNo_user,@AVERAGE_COST," +
                    "@LP_COST,@STD_COST,@QTY_UNFILLED,@DATETIME,@Batch_No,@Expiry_Date," +
                    "@PRINT_ITEM, @QTY_BILLED,@ITEM6_NO,@ITEM7_NO,@ITEM8_NO,@IMPORT_KEY)";

                                            //  cfs.Audit\_Log("Invoice", ddl\_Inv.Text, txt\_Custcode.Text, strpcode, strUom, Prodqty, true, false, false);
                                            //sqlstr = "insert into invINVOICEDETAILS (" + sfield + ") values (" + sdata + ")";
                                            //sqlstr = "insert into invINVOICEDE
                    
                    P Offline
                    P Offline
                    palikhelsanjeeb
                    wrote on last edited by
                    #20

                    Hi Tarun, may b helpful to use the required isolation levels while locking the transactions. may b u could watch the video tutorial in mva site course:

                    Developing Microsoft SQL Server Databases

                    chapter 4: managing transaction if you prefer watching rather than reading link: Developing Microsoft SQL Server Databases – Microsoft Virtual Academy[^]

                    T 1 Reply Last reply
                    0
                    • P palikhelsanjeeb

                      Hi Tarun, may b helpful to use the required isolation levels while locking the transactions. may b u could watch the video tutorial in mva site course:

                      Developing Microsoft SQL Server Databases

                      chapter 4: managing transaction if you prefer watching rather than reading link: Developing Microsoft SQL Server Databases – Microsoft Virtual Academy[^]

                      T Offline
                      T Offline
                      TarunKumarSusarapu
                      wrote on last edited by
                      #21

                      Thank you Mr.palikhelsanjeeb.I will go through this link and let you know the result if it is useful. :)

                      1 Reply Last reply
                      0
                      Reply
                      • Reply as topic
                      Log in to reply
                      • Oldest to Newest
                      • Newest to Oldest
                      • Most Votes


                      • Login

                      • Don't have an account? Register

                      • Login or register to search.
                      • First post
                        Last post
                      0
                      • Categories
                      • Recent
                      • Tags
                      • Popular
                      • World
                      • Users
                      • Groups