Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query. Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^] How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^] Query Parameterization Cheat Sheet | OWASP[^]
Private Function GetDataSource(strCampusName) As DataTable
Dim conxnString As String = "Data Source=Raabi\SQLEXPRESS;Initial Catalog=StaffReport; Integrated Security=True"
Dim cmdText As String = "SELECT * from tblStaffInfo tbl WHERE tbl.CampusName = @CampusName"
Using conxn As New SqlConnection(conxnString)
Using cmd As New SqlCommand(cmdText, conxn)
cmd.Parameters.AddWithValue("@CampusName", strCampusName)
Dim DGVadapter As New SqlDataAdapter(cmd)
Dim ds As New DataSet()
DGVadapter.Fill(ds)
Return ds.Tables(0)
End Using
End Using
End Function
"These people looked deep within my soul and assigned me a number based on the order in which I joined." - Homer
