Saving file path in MySQL

Question

Saving file path in MySQL

Navigation

#1 by (5 votes)
#2 by (1 votes)

3

I'm having difficulty saving file address to the database. When saving the address to the bank it is adding the amount of times I used OpenFileDialog to save a file.

Save the address always so C:\Users\phili\Desktop\PDF_SGIM_QUALIDADE_CNH\certificadocalibracao.pdf12

Always place a numeral after the extension.

Why is this happening?

private void tsbtnGravar_Click(object sender, EventArgs e)
        {

            try
            {
                if (identificacaoTextBox.Text == "")
                {
                    MessageBox.Show("Informe a Identificação do Instrumento.", "Warning", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                    identificacaoTextBox.Focus();
                }

                else if (descricaoTextBox.Text == "")
                {
                    MessageBox.Show("Informe s Descrição do Instrumento.", "Warning", MessageBoxButtons.OK, MessageBoxIcon.Warning);
                    descricaoTextBox.Focus();
                }

                else
                {
                    if (status == "novo")
                    {
                        cmd.CommandText = "INSERT INTO tb_Intrumento (identificacao,Descricao,Marca, Modelo,Serial,Capacidade,Frequencia,Data_Calibracao,Vencimento_Calibrecao,Certificado) VALUES('" + identificacaoTextBox.Text + "','" + descricaoTextBox.Text + "','" + marcaTextBox.Text + "','" + modeloTextBox.Text + "','" + txb_Numero_Serie.Text + "','" + capacidadeTextBox.Text + "','" + tcb_Frequencia_Calibracao.Text + "','" + txb_Data_Calibracao.Text + "','" + txb_Vencimento_Calibracao.Text + "','" + txb_caminho.Text + "','" +
                        cmd.ExecuteNonQuery();
                        cmd.Dispose();
                        MessageBox.Show("Registro salvo com sucesso.", "Salvar", MessageBoxButtons.OK, MessageBoxIcon.Information);
                    }

                    else if (status == "editar")
                    {
                        cmd.CommandText = "INSERT INTO tb_Instrumento SET Identificacao='" + identificacaoTextBox.Text + "',  Descricao='" + descricaoTextBox.Text + "',Marca='" + marcaTextBox.Text + "', Modelo='" + modeloTextBox.Text + "', Serie='" + txb_Numero_Serie.Text + "', Capacidade='" + capacidadeTextBox.Text + "', Frequencia='" + tcb_Frequencia_Calibracao.Text + "', Data_Calibracao='" + txb_Data_Calibracao.Text + "', Vencimento_Calibracao='" + txb_Vencimento_Calibracao.Text + "', Certificado='"  + txb_caminho.Text +
                             lstvInstrumentos.Items[lstvInstrumentos.FocusedItem.Index].Text + "'";
                        cmd.ExecuteNonQuery();
                        MessageBox.Show("Registro atualizado com sucesso.", "Atualizar", MessageBoxButtons.OK, MessageBoxIcon.Information);
                    }
                    carregaVariaveis();
                    btn_Limpar_Dados.PerformClick();
                }
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.ToString());
            }
        }

Below is the code that inserts the path in textbox :

private void btn_Carregar_Certificado_Click(object sender, EventArgs e)
        {

            OpenFileDialog abrir = new OpenFileDialog();
            abrir.ShowDialog();

           // openFileDialog1.ShowDialog();
            txb_caminho.Text = abrir.FileName.Replace(@"\", @"\");
        }

sql c# .net ado.net

asked by anonymous 21.06.2016 / 17:34

2 answers

5

Query securely and the problem will resolve itself:

var cmd = new SqlCommand("INSERT INTO tb_Instrumento SET Identificacao = @Identificao, Descricao = @Descricao, ... aqui vai colocar todos os campos ..., Certificado = @Certificado, ... pode ter outros aqui", connection);

cmd.Parameters["@Identificacao"].Value = identificacaoTextBox.Text;
cmd.Parameters["@Descricao"].Value = descricaoTextBox.Text;
... todos os parâmetros aqui
cmd.Parameters["@Certificado"].Value = txb_caminho.Text;

The code of the way it is is not only wrong, it has serious security problems.

21.06.2016 / 18:07

Is it indifferent to use SQL Server or MySQL with PHP? How to implement classes with private method?

score 1 · Accepted Answer

The cmd.CommandText of if (status == "novo") is concatenating the next line along with the query.
Since the next line is cmd.ExecuteNonQuery(); , which returns the Id of the insert it just made.

So just put ; after txb_caminho.Text instead of how it is now: _Calibracao.Text + "','" + txb_caminho.Text + "','" + .