33 votes

Login form C# SQL

SQL Injection alarm Don't use user passed text in your sql statements if you aren't using parameters. From: https://stackoverflow.com/a/7505842/2655508 Using parameters helps prevent SQL Injection ...
user avatar
  • 49.9k
31 votes
Accepted

Select first value if exists, otherwise select default value

The shorter query I can think of is SELECT COALESCE(MAX(Data), 'Default Value') FROM Configuration WHERE Name = 'NameOfConfiguration'; If the configuration is ...
user avatar
  • 478
31 votes
Accepted

Performing and timing loops with SQL queries

In the case of both if your while loops, you could easily make them for loops instead, which tends to be the best practice. <...
user avatar
18 votes
Accepted

Creating ADODB Parameters on the fly

This seems extra complexity with no purpose. You take any type variable and automatically convert it to a parameter (this is good). But then something strange happens, you look at the type of the ...
user avatar
  • 476
18 votes

Login form C# SQL

Cleartext passwords Not a code-specific issue exactly but it would appear that you are storing the user's passwords in clear text. This means that anyone gaining access to the LOGIN_Tab would be ...
user avatar
16 votes
Accepted

Average time to first answer

There are a few things that are off in this query. Going through them in some sense of order: I am still a fan of 'old style' joins, but, the CTE concept is a real winner in SQL Server, so, instead ...
user avatar
  • 96.7k
16 votes
Accepted

Optimize query containing too many inner join and rows

Code Review Stack Exchange advice It really helps if you explain, in plain English, what your code does or is supposed to do. As it stands, nobody has any idea what your code is supposed to do, and ...
user avatar
  • 20.3k
16 votes
Accepted

Calculate amount of mugs StackExchange should give away so I'll receive one

Documentation I think that what the query is doing is looking at your reputation rank, then rounding up to the nearest 50. It would be nice to hit "edit description" and document that for the ...
user avatar
16 votes
Accepted

Top users under age 30, sorted by age, with rank

A few things, some nitpicks, some UX, some probably-bugs. What Lyle's Mug has already stated is also part of my answer, but first things first: UX This query is quite unwieldy to use, because all ...
user avatar
  • 25k
16 votes

Login form C# SQL

In addition to Heslacher's answer I would also look at the using statement. It is very important to keep a handle on resources like Sql Connections to ensure they ...
user avatar
  • 439
15 votes
Accepted

Executing large SQL script file with GO statements using ADO

I am unfortunately not able to test your code, but I am able to read your code. Very well. Your code is overall very well written and you seem to adhere to most of the Delphi coding conventions that I ...
user avatar
14 votes

Winterbash 2014 "Red Shirt" Estimation

I find this pretty nicely done and really hard to pick on. But here's a little something. Instead of writing this condition this way: ...
user avatar
  • 107k
14 votes
Accepted

Searching for bad Minecraft questions on Gaming.SE

The use of the Tags field on the Post is a poor choice for the query. It relies on a table scan, which is slow, because it has to check each question. Note, you can use the ...
user avatar
  • 96.7k
14 votes

C# function to execute queries in a SQL Server database

SqlConnection implements the IDisposable interface, and so does the SqlDataAdapter class - ...
user avatar
14 votes
Accepted

A wounded Zombie finder, or: how to find the almost dead undead?

Not utterly wrong, but q.PostTypeId = 1 and AND a.PostTypeId = 2 are superfluous. The only post types with a non-null ...
user avatar
13 votes

Select first value if exists, otherwise select default value

The query feels tortured because SQL is designed to work with sets of data. You're using SQL like an ordinary programming language, trying to turn tables into scalars, and embedding special values in ...
user avatar
13 votes

Top users under age 30, sorted by age, with rank

If you write the query where you first order by rank and then by age, you will get a better result, and you should be able to get rid of part of the where statement, which I would think would make the ...
user avatar
  • 28.5k
13 votes
Accepted

"How can I make this SEDE query better?" (bad title finder)

Your query is well structured, and consistent, but there is one issue you have failed to incorporate.... not all bad questions have a user. When questions are migrated, or there's a user deleted, the ...
user avatar
  • 96.7k
13 votes

C# function to execute queries in a SQL Server database

There are two problems with this that are immediately apparent: You are executing arbitrary SQL. This is a SQL Injection flaw. You'll want to use parameterized queries. You are catching an exception ...
user avatar
12 votes

Creating ADODB Parameters on the fly

AdoConverter For better extensibility, the methods in that class shouldn't be calling each others the way ToLongParameter is calling ...
user avatar
12 votes

Average time to first answer

I think overall your code is good! Nothing stands out as being particularly inefficient. Nitpicking I find your keyword formatting to be inconsistent: I see declare ...
user avatar
  • 20.3k
12 votes
Accepted

Transaction handling for multiple SQL statements

Naming Constants in .NET should be named using PascalCase. See c-sharp-naming-convention-for-constants Your ...
user avatar
  • 49.9k
12 votes

Winterbash 2014 "Red Shirt" Estimation

-- Number of weeks must not go into the future, hence the following: SET @weeks_ago = (CASE WHEN @weeks_ago >0 THEN -@weeks_ago ELSE @weeks_ago END); This ...
user avatar
12 votes

Login form C# SQL

Security issues are covered, so just a bit on the code itself. You have three nearly identical pieces of code, inside a switch-statement. That seems to be a code-smell. Apart from that, I'm missing a ...
user avatar
  • 396
11 votes

Creating ADODB Parameters on the fly

I would opt for strict type checking here. It seems a bit lazy to force it to a single when implicit in the function name. No need to use a variant and force it to a Single via a cast. IMHO, if the ...
user avatar
  • 111
11 votes

Speeding up a stored procedure

A couple of things to think about while writing your query.... Variable Naming ...
user avatar
  • 28.5k
11 votes

Average time to first answer

Logical correctness c is not c++; java is not javascript. Using CHARINDEX(…, Q.Tags) to inspect a comma-delimited string is a bad idea. Join against the ...
user avatar
11 votes

Calculate amount of mugs StackExchange should give away so I'll receive one

Stylistically I'd declare variables just like in program code: Each on a single line. Also your nested Select seems a little forced and cramped, as well as the calculation code. You maybe want to add ...
user avatar
  • 25k
11 votes

Winterbash 2014 "Red Shirt" Estimation

Comments ...
user avatar
  • 30.7k
11 votes

Performing and timing loops with SQL queries

Why isn't using (SqlConnection con1 = new SqlConnection()) inside your while loop, right before ...
user avatar
  • 10.6k

Only top scored, non community-wiki answers of a minimum length are eligible