Search Results

Search found 14159 results on 567 pages for 'notes from the field'.

Page 292/567 | < Previous Page | 288 289 290 291 292 293 294 295 296 297 298 299  | Next Page >

  • Prevent SQL Injection in Dynamic column names

    - by Mr Shoubs
    I can't get away without writing some dynamic sql conditions in a part of my system (using Postgres). My question is how best to avoid SQL Injection with the method I am currently using. EDIT (Reasoning): There are many of columns in a number of tables (a number which grows (only) and is maintained elsewhere). I need a method of allowing the user to decide which (predefined) column they want to query (and if necessary apply string functions to). The query itself is far too complex for the user to write themselves, nor do they have access to the db. There are 1000's of users with varying requirements and I need to remain as flexible as possible - I shouldn't have to revisit the code unless the main query needs to change - Also, there is no way of knowing what conditions the user will need to use. I have objects (received via web service) that generates a condition (the generation method is below - it isn't perfect yet) for some large sql queries. The _FieldName is user editable (parameter name was, but it didn't need to be) and I am worried it could be an attack vector. I put double quotes (see quoted identifier) around the field name in an attempt to sanitize the string, this way it can never be a key word. I could also look up the field name against a list of fields, but it would be difficult to maintain on a timely basis. Unfortunately the user must enter the condition criteria, I am sure there must be more I can add to the sanatize method? and does quoting the column name make it safe? (my limited testing seems to think so). an example built condition would be "AND upper(brandloaded.make) like 'O%' and upper(brandloaded.make) not like 'OTHERBRAND'" ... Any help or suggestions are appreciated. Public Function GetCondition() As String Dim sb As New Text.StringBuilder 'put quote around the table name in an attempt to prevent some sql injection 'http://www.postgresql.org/docs/8.2/static/sql-syntax-lexical.html sb.AppendFormat(" {0} ""{1}"" ", _LogicOperator.ToString, _FieldName) Select Case _ConditionOperator Case ConditionOperatorOptions.Equals sb.Append(" = ") ... End Select sb.AppendFormat(" {0} ", Me.UniqueParameterName) 'for parameter Return Me.Sanitize(sb) End Function Private Function Sanitize(ByVal sb As Text.StringBuilder) As String 'compare against a similar blacklist mentioned here: http://forums.asp.net/t/1254125.aspx sb.Replace(";", "") sb.Replace("'", "") sb.Replace("\", "") sb.Replace(Chr(8), "") Return sb.ToString End Function Public ReadOnly Property UniqueParameterName() As String Get Return String.Concat(":" _UniqueIdentifier) End Get End Property

    Read the article

  • How to fix an error in a Mercurial changeset comment?

    - by Sly
    Is there a way to rewrite the hg commit message if the wrong information was entered? We always include our Bug ID when we commit a changeset. For instance: hg commit -m "Bug 14585: LastName field should be mandatory" But If I put the wrong bug ID, is there a way (through an extension maybe) to fix the comment once the changeset has been committed and pushed to a central repo?

    Read the article

  • JNI - GetObjectField returns NULL

    - by Daniel
    I'm currently working on Mangler's Android implementation. I have a java class that looks like so: public class VentriloEventData { public short type; public class _pcm { public int length; public short send_type; public int rate; public byte channels; }; _pcm pcm; } The signature for my pcm object: $ javap -s -p VentriloEventData ... org.mangler.VentriloEventData$_pcm pcm; Signature: Lorg/mangler/VentriloEventData$_pcm; I am implementing a native JNI function called getevent, which will write to the fields in an instance of the VentriloEventData class. For what it's worth, it's defined and called in Java like so: public static native int getevent(VentriloEventData data); VentriloEventData data = new VentriloEventData(); getevent(data); And my JNI implementation of getevent: JNIEXPORT jint JNICALL Java_org_mangler_VentriloInterface_getevent(JNIEnv* env, jobject obj, jobject eventdata) { v3_event *ev = v3_get_event(V3_BLOCK); if(ev != NULL) { jclass event_class = (*env)->GetObjectClass(env, eventdata); // Event type. jfieldID type_field = (*env)->GetFieldID(env, event_class, "type", "S"); (*env)->SetShortField( env, eventdata, type_field, 1234 ); // Get PCM class. jfieldID pcm_field = (*env)->GetFieldID(env, event_class, "pcm", "Lorg/mangler/VentriloEventData$_pcm;"); jobject pcm = (*env)->GetObjectField( env, eventdata, pcm_field ); jclass pcm_class = (*env)->GetObjectClass(env, pcm); // Set PCM fields. jfieldID pcm_length_field = (*env)->GetFieldID(env, pcm_class, "length", "I"); (*env)->SetIntField( env, pcm, pcm_length_field, 1337 ); free(ev); } return 0; } The code above works fine for writing into the type field (that is not wrapped by the _pcm class). Once getevent is called, data.type is verified to be 1234 at the java side :) My problem is that the assertion "pcm != NULL" will fail. Note that pcm_field != NULL, which probably indicates that the signature to that field is correct... so there must be something wrong with my call to GetObjectField. It looks fine though if I compare it to the official JNI docs. Been bashing my head on this problem for the past 2 hours and I'm getting a little desperate.. hoping a different perspective will help me out on this one.

    Read the article

  • .NET Library to Identify Pitches

    - by Antoni
    I'd like to write a simple program(preferably in C#) to which I sing a pitch using a mic and the program identifies to which musical note that pitch corresponds. Thank you very much for your prompt responses. I clarify: I'd like a (preferably .NET) library that would identify the notes I sing. I'd like that such a library: Identifies a note when I sing(a note from the chromatic scale). Tells me how much I'm off from the closest note. I intend to use such a library to sing one note a time.

    Read the article

  • Call out to script to stop with attribute in wWWHomePage

    - by Steven Maxon
    I'm gettinga n error message in line 8 when I try to call out the script to stop when it finds teh attribute in the Web page: field in AD. Set objSysInfo = CreateObject("ADSystemInfo") strUserDN = objSysInfo.UserName Set objUser = GetObject("LDAP://" & strUserDN) strwWWHomePage = objItem.Get("wWWHomePage") If wWWHomePage 6 Then wscript.quit Else Set ppt = CreateObject("PowerPoint.Application") ppt.Visible = True ppt.Presentations.Open "\\abngan01\tracking\ppt.pptx" End If

    Read the article

  • Form validation Issue

    - by Nimbuz
    I am using jQuery validation plugin for form validation. The problem I am facing is when I have inline labels.. For Example: <input type="text" name="myinput" value="Enter your ...."> This is the sample case where validation is failing because the 'value' is set for input field. Is there any workaround? How do I ignore default/label values?

    Read the article

  • jQuery returning two elements for each one it finds?

    - by John Rudy
    I'll start by saying I'm fairly new to jQuery. For the most part, I've found it intuitive and powerful, but this one circumstance has me thoroughly stumped. In the following method, the call to .each() returns two elements for every one found. It iterates over a set of table rows given IDs starting with the word, "communication," and followed by an ID number. For each row it returns, it processes twice. Using Firebug, I've validated that the DOM only has a single instance of each table row in question. Also using Firebug, I've validated that the method is not being called twice; the iteration in .each() is truly going over each returned table row twice. By the time all the AJAX call goodness is done, I'll have two entries in the database for each row created in the table. This is the code that's causing the issues: function getCommunications() { var list = $('[id^=communication]'); var communications = new Array(); list.each(function () { var communication = { ID: $(this).find('.commCompanyID').val(), /* * SNIP: more object properties here that are * unnecessary to this discussion */ }; communications.push(communication); }); return communications; } At the point of return communications, the Array returned will contain twice as many elements as there are table rows. I should note that nearly identical code (but going against specific lists of divs) is working on the same page. It's just the table that's suffering the issues. I'm using jQuery 1.4.1, the version which shipped with Visual Studio .NET 2010. The table markup is fully dynamic -- that is, aside from the header row, it's dependent on data either returned at page load or created by the user via a dialog box. I'll drop in just the code for what's created at page load; again using Firebug I've validated that what I create dynamically when an end user creates a row with the dialog box matches. (This should be readable by anyone, but for the record this is an ASP.NET MVC 2.0 project.) <table id="commTable"> <tr> <th></th> <th> Date / Time </th> <th> Contact </th> <th> Type </th> <th> Duration </th> <th> Notes </th> </tr> <% foreach (var item in Model) { %> <tr id="communication<%: item.ID %>"> <td> <a href="#" onclick="showEditCommunicationForm(<%: item.ID %>"> Edit</a> <span class="commDeleteButton"> <a href="#" onclick="deleteCommunication(<%: item.ID %>)"> Delete</a> </span> </td> <td> <span class="commDateTime"><%: item.DateTime %></span> <input type="hidden" class="commID" value="<%: item.ID %>" /> <input type="hidden" class="commIsDeleted" value="<%: item.IsDeleted %>" /> </td> <td> <span class="commSourceText"><%: item.Company.CompanyName %></span> <input type="hidden" class="commCompanyID" value="<%: item.CompanyID %>" /> </td> <td> <%: item.CommunicationType.CommunicationTypeText %> <input type="hidden" class="commTypeID" value="<%: item.CommunicationTypeID %>" /> </td> <td> <span class="commDuration"><%: item.DurationMinutes %></span> Minutes </td> <td> <span class="commNotes"><%: item.Notes %></span> </td> </tr> <% } %> </table>

    Read the article

  • invalid header file while using jar for archiving

    - by arshad
    When i use this cmd line : jar cmf arshad.mf ars.jar *.class i get this error : invalid header field name:Manifest-version This is my manifest file : Manifest-Version: 1.0 Main-Class:t i made the manifest file with notepad in UTF-8 encoding - is there any problem with the manifest ?

    Read the article

  • How to listen to keyboard events in GWT table?

    - by Olaf Mertens
    In my GWT program I have a table that has a selected row. I'd like to move the row selection with the up- and down-keys on the keyboard. So I have to catch the key events somehow. The GWT docs handle key events in input fields only. But I don't have an input field! Is this possible at all? Maybe it is a DOM/Javascript restriction that GWT cannot work around...

    Read the article

  • long vs. short branches in version control

    - by Vincenzo
    I wonder whether anyone knows some research done with the question "What is good/bad in long/short branches in version control?" I'm specifically interested in academic researches performed in this field. My questions are: What problems (or conflicts) long branches may produce and how to deal with them How to split a big task onto smaller branches/sub-tasks How to coordinate the changes in multiple short branches, related to the same code Thanks in advance for links and suggestions!

    Read the article

  • Why do software engineers hate writing documentation?

    - by Stewart Johnson
    I ask because I quite enjoy it! I'm talking about design documentation and implementation notes (NOT user manuals), which are non-existent in most of the codebases I've been handed. I can understand why a developer wouldn't want to write requirements (that's the analyst's job) or the user documentation (that's a technical writer's job) but I don't get why developers hate writing design docs. I don't think I would feel as if I'd finished the job if I only wrote the code and walked away -- mainly because when I've been introduced to code-only situations I've seen how hard it is to figure out what's been done and what the software does. I would hate for people to suffer the same situation when inheriting my code. What makes you loath writing supporting documentation for your code?

    Read the article

  • ActiveScaffold: How do I set the default value for a drop down list?

    - by Swamy g
    So I have this create form to create schedules where there is a bunch of fields and one of them is seasons. And seasons table has a field called 'is_current' which if set to 1 tells us that it is the current season. When the create form is display , I want the current season to be selected by default in the seasons drop down. Any help will be appreciated. Thanks.

    Read the article

  • SQL Server IS_NULLABLE

    - by J Harley
    Good Morning, Just a quick question what this field actually means? I am trying to create an export script which follows this standard: lname varchar(30) **NOT NULL**, So if last name is_nullable=yes then would I put NULL rather than NOT NULL at the *'d code. Many Thanks, Joel

    Read the article

  • Varchar2 and Oracle quick question

    - by DAVID
    Hi guys im using varchar2 for a product name field, but when i query the databa from the run SQL command line it shows too many empty spaces, how can i fixe this withouth changing the datatype here is the link to the ss http://img203.imageshack.us/img203/20/varchar.jpg

    Read the article

  • How would I UPDATE these table entries with SQL?

    - by CT
    I am working on an Asset Database problem. I enter assets into a database. Every object is an asset and has variables within the asset table. An object is also a type of asset. In this example the type is server. Here is the Query to retrieve all necessary data: SELECT asset.id ,asset.company ,asset.location ,asset.purchaseDate ,asset.purchaseOrder ,asset.value ,asset.type ,asset.notes ,server.manufacturer ,server.model ,server.serialNumber ,server.esc ,server.warranty ,server.user ,server.prevUser ,server.cpu ,server.memory ,server.hardDrive FROM asset LEFT JOIN server ON server.id = asset.id WHERE asset.id = '$id' How would I write a query to update an asset?

    Read the article

  • Theory of computation - Using the pumping lemma for CFLs

    - by Tony
    I'm reviewing my notes for my course on theory of computation and I'm having trouble understanding how to complete a certain proof. Here is the question: A = {0^n 1^m 0^n | n>=1, m>=1} Prove that A is not regular. It's pretty obvious that the pumping lemma has to be used for this. So, we have |vy| = 1 |vxy| <= p (p being the pumping length, = 1) uv^ixy^iz exists in A for all i = 0 Trying to think of the correct string to choose seems a bit iffy for this. I was thinking 0^p 1^q 0^p, but I don't know if I can obscurely make a q, and since there is no bound on u, this could make things unruly.. So, how would one go about this?

    Read the article

  • Summary of the last decade of garbage collection?

    - by Ben Karel
    I've been reading through the Jones & Lin book on garbage collection, which was published in 1996. Obviously, the computing world has changed dramatically since then: multicore, out-of-order chips with large caches, and even larger main memory in desktops. The world has also more-or-less settled on the x86 and ARM microarchitectures for most consumer-facing systems. How has the field of garbage collection changed since the seminal book was published?

    Read the article

  • Injecting Annotated Bean into Regular Bean

    - by jboyd
    AppContext.xml <bean id="myBean" class="com.myapp.MyClass"> <property ref="myService"/> </bean> MyService.java @Service public class MyService { ... } This will throw an exception stating that no bean can be found for property "myService", which I understand because it can't be found in the context files, but I can autowire that field in other spring managed beans, but I need to explicitly build the bean in my context because the POJO is not editable in the scope of my project.

    Read the article

  • Oracle get previous day records

    - by Phill Pafford
    Ok I think I'm getting the previous year instead of the previous day, but I need to previous day. SELECT TO_DATE(TO_CHAR(CURRENT_DATE, 'YYYY-MM-DD'),'YYYY-MM-DD') - 1 FROM Dual I'm comparing it to a datetime stamp in this format and wish to get all the rows from the previous day. YYYY-MM-DD HH:MM:SS So I'm trying something like this SELECT field,datetime_field FROM database WHERE datetime_field > TO_DATE(TO_CHAR(CURRENT_DATE, 'YYYY-MM-DD'),'YYYY-MM-DD') - 1

    Read the article

< Previous Page | 288 289 290 291 292 293 294 295 296 297 298 299  | Next Page >