Skip to main content
33 votes

Login form C# SQL

SQL Injection alarm Don't use user passed text in your sql statements if you aren't using parameters. From: https://stackoverflow.com/a/7505842/2655508 Using parameters helps prevent SQL Injection ...
Heslacher's user avatar
  • 50.4k
18 votes

Login form C# SQL

Cleartext passwords Not a code-specific issue exactly but it would appear that you are storing the user's passwords in clear text. This means that anyone gaining access to the LOGIN_Tab would be ...
motosubatsu's user avatar
16 votes

Login form C# SQL

In addition to Heslacher's answer I would also look at the using statement. It is very important to keep a handle on resources like Sql Connections to ensure they ...
Geek's user avatar
  • 439
14 votes

C# function to execute queries in a SQL Server database

SqlConnection implements the IDisposable interface, and so does the SqlDataAdapter class - ...
Mathieu Guindon's user avatar
14 votes
Accepted

A wounded Zombie finder, or: how to find the almost dead undead?

Not utterly wrong, but q.PostTypeId = 1 and AND a.PostTypeId = 2 are superfluous. The only post types with a non-null ...
Glorfindel's user avatar
  • 1,089
13 votes

C# function to execute queries in a SQL Server database

There are two problems with this that are immediately apparent: You are executing arbitrary SQL. This is a SQL Injection flaw. You'll want to use parameterized queries. You are catching an exception ...
Greg Burghardt's user avatar
12 votes

Login form C# SQL

Security issues are covered, so just a bit on the code itself. You have three nearly identical pieces of code, inside a switch-statement. That seems to be a code-smell. Apart from that, I'm missing a ...
oerkelens's user avatar
  • 396
10 votes

Login form C# SQL

using as already covered SQL injection as already covered For getting a single row Reader is more efficient than ...
paparazzo's user avatar
  • 6,016
9 votes
Accepted

SQL query to compare two XML columns

Try this query instead on your data and tell how it performs. Not sure it will return exactly the same as your query but it should be close enough so you can adjust to what you want. ...
Mikael Eriksson's user avatar
9 votes
Accepted

App for providing accounting solutions for clients

You only asked for suggestions how to make this code faster. However, after discussing what might be the issue with performance here, I will provide some comments regarding general maintainability ...
M.Doerner's user avatar
  • 1,510
8 votes

Accounting system data database design

Some quick remarks: Why the (incomprehensible) prefixes in the table names? Why not use the SCHEMA instead (and use proper words)? Why are all your table fields ...
BCdotWEB's user avatar
  • 11.2k
7 votes
Accepted

Creating a random code and saving if it does not exist

There are numerous problems here. There are 26^10 vouchers in the voucher space, but only 2^32 possible seeds to the random ...
Eric Lippert's user avatar
  • 14.9k
7 votes
Accepted

Zombie killers ranking

As a heads up - we have very different formatting styles for our code. Feel free to ignore that difference and don't consider it a comment on your style (unless you prefer mine, in which case please ...
Dan Oberlam's user avatar
  • 7,814
7 votes

NewSequentialId - pure net core 2.2 implementation of sql server function

You want to reduce both computation time and memory allocation. Memory allocation itself takes time, so that's a good place to start -- try to find all the places where you're allocating memory and ...
Jeff's user avatar
  • 850
7 votes

Write SQL Server table to Parquet file

Quick remarks: Your code doesn't follow the coding conventions (camel-case, pascal-case, etc.). string SourceObject_IsTable = args[2]; has a bad name and isn't ...
BCdotWEB's user avatar
  • 11.2k
6 votes
Accepted

Calculating price with a sub query

You have the same column twice, I think I would start there in your quest to make your SQL "sexier" (I probably wouldn't use that term in a professional environment [i.e. interviews]). ...
Malachi's user avatar
  • 28.7k
6 votes
Accepted

Generate SQL for translated resources from Excel Spreadsheet

I'll concentrate on the "pure" Excel part of your code Use fully qualified ranges and avoid Activate/Select statements to avoid unexpected (both form user and code itself) "sheets-jumping" breaking ...
user3598756's user avatar
6 votes
Accepted

Create database connection and run the insert, delete, update queries class

What does the abstract ConnectionManager class buy you ? Nothing, really. The passed-in passedOnConstring is only used for ...
Heslacher's user avatar
  • 50.4k
6 votes

Create database connection and run the insert, delete, update queries class

One note I think you should have: I'm not sure if you realize or not, but readonly doesn't stop the underlying value of the field from changing. It stops ...
Der Kommissar's user avatar
6 votes

T-SQL UDF to replace replace base URLs

Your code looping over string functions doesn't seem like something SQL Server is optimized for. Database systems are optimized for set based operations, not looping. I understand the confusion ...
Tom V's user avatar
  • 161
6 votes
Accepted

Prompting user for connection parameters to SQL Server

It doesn't matter what you do with this code, the ConnectionString can always be accessed in the SqlConnection. As a test, here'...
Der Kommissar's user avatar
6 votes

Login form C# SQL

General issues SqlConnection loginCon = new SqlConnection("Data Source=******;Initial Catalog=***;Persist Security Info=True;User ID=*****;Password=**********"); ...
Alejandro's user avatar
  • 496
6 votes
Accepted

Update SQL database with using statement and SqlParameters

Stacking the using statements I am particularly difficult to please with code that has nesting, and I highly prefer to stack the ...
Svek's user avatar
  • 1,023
6 votes

Employee Attendance structure design

I would change my parameters to simply require "login" and "logout" timestamps. Then calculate the difference between those two DateTimes. I would move all validation into DI ...
Morten Bork's user avatar
5 votes
Accepted

Parameterized Chutes & Ladders simulator using SQL stored procedure

This is a simple review, but I figure I had to start some where. there are a few comments that I don't think are necessary to understand the code. ...
Malachi's user avatar
  • 28.7k
5 votes
Accepted

Database credentials and connector including encryption

Encrypts password prior to storing in a ConnectionCredentials object Why are you encrypting the password in this object? There are very few things attacks that it would actually prevent that I can ...
Dan's user avatar
  • 3,748
5 votes

"How can I make this SEDE query better?" (bad title finder)

Let me address a possible DRY issue in the query in exchange for possible poorer performance. I'm in particular talking about this bit: ...
rene's user avatar
  • 305
5 votes

Fetching busy students and their latest product

Without additional info about indexes and row counts it's hard to tell, but the most elegant solution is probably using Analytical Functions (using employees instead of students): ...
dnoeth's user avatar
  • 1,172
5 votes

Batch file to backup and update SQL Server DBs

Well, in case anyone is interested, here is what I've come up with: BASICS I like using the :: type of comments over REM ...
carlossierra's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible