33 votes

Login form C# SQL

SQL Injection alarm Don't use user passed text in your sql statements if you aren't using parameters. From: https://stackoverflow.com/a/7505842/2655508 Using parameters helps prevent SQL Injection ...
Heslacher's user avatar
  • 50.4k
18 votes

Login form C# SQL

Cleartext passwords Not a code-specific issue exactly but it would appear that you are storing the user's passwords in clear text. This means that anyone gaining access to the LOGIN_Tab would be ...
motosubatsu's user avatar
16 votes

Login form C# SQL

In addition to Heslacher's answer I would also look at the using statement. It is very important to keep a handle on resources like Sql Connections to ensure they ...
Geek's user avatar
  • 439
14 votes

C# function to execute queries in a SQL Server database

SqlConnection implements the IDisposable interface, and so does the SqlDataAdapter class - ...
Mathieu Guindon's user avatar
14 votes
Accepted

A wounded Zombie finder, or: how to find the almost dead undead?

Not utterly wrong, but q.PostTypeId = 1 and AND a.PostTypeId = 2 are superfluous. The only post types with a non-null ...
Glorfindel's user avatar
  • 1,089
13 votes

C# function to execute queries in a SQL Server database

There are two problems with this that are immediately apparent: You are executing arbitrary SQL. This is a SQL Injection flaw. You'll want to use parameterized queries. You are catching an exception ...
Greg Burghardt's user avatar
12 votes

Login form C# SQL

Security issues are covered, so just a bit on the code itself. You have three nearly identical pieces of code, inside a switch-statement. That seems to be a code-smell. Apart from that, I'm missing a ...
oerkelens's user avatar
  • 396
11 votes
Accepted

Deleting millions of rows from a MSSQL server table

The performance problem is due to the non-sargable expression YEAR(CREATEDATE). Applying a function to a column in a WHERE clause prevents efficient use of the ...
Dan Guzman's user avatar
10 votes
Accepted

Query to count interactions between users

Before we begin with the code... I just want to address one thing regarding test cases with sample data. To get the best out of a performance review of your queries, try to provide a sample that's as ...
Phrancis's user avatar
  • 20.4k
10 votes

Login form C# SQL

using as already covered SQL injection as already covered For getting a single row Reader is more efficient than ...
paparazzo's user avatar
  • 5,946
9 votes
Accepted

Replacement for sp_MSforeachdb

First off, please heed the advice from @Zak about Version Control System (VCS). That should be the first take-away from this. Slashy comment block You have 31 lines, 4462 characters of slashy ...
Phrancis's user avatar
  • 20.4k
9 votes
Accepted

SQL query to compare two XML columns

Try this query instead on your data and tell how it performs. Not sure it will return exactly the same as your query but it should be close enough so you can adjust to what you want. ...
Mikael Eriksson's user avatar
9 votes
Accepted

App for providing accounting solutions for clients

You only asked for suggestions how to make this code faster. However, after discussing what might be the issue with performance here, I will provide some comments regarding general maintainability ...
M.Doerner's user avatar
  • 1,490
8 votes

Accounting system data database design

Some quick remarks: Why the (incomprehensible) prefixes in the table names? Why not use the SCHEMA instead (and use proper words)? Why are all your table fields ...
BCdotWEB's user avatar
  • 11.2k
7 votes

Class Module to wrap up classic ADO call to SQL-server

Suggestions: Don't assume the cursor type of the recordset, the user might want a different type. Consider making a ConnectionString class that lets the user use properties to get and let the ...
ThunderFrame's user avatar
  • 1,959
7 votes
Accepted

Class Module to wrap up classic ADO call to SQL-server

Don't do this: ':::::::::::::::::::: ':: ':: Class Variable Declarations ':: ':::::::::::::::::::: Fields appear in the declarations section of a class, you can'...
Mathieu Guindon's user avatar
7 votes
Accepted

Deduplicating value pairs between 2 columns

If val1 and val2 are comparable it is easy to find the distinct values, using set-based operations, by normalizing first and ...
Johnbot's user avatar
  • 2,974
7 votes

Stored procedure to query custom data tables as dynamic SQL

Does this open the door to destructive injection attacks? It depends, but potentially, yes it can, especially with dynamic SQL, which you should try to avoid unless it is absolutely necessary. You ...
Phrancis's user avatar
  • 20.4k
7 votes
Accepted

Creating a random code and saving if it does not exist

There are numerous problems here. There are 26^10 vouchers in the voucher space, but only 2^32 possible seeds to the random ...
Eric Lippert's user avatar
  • 14.9k
7 votes
Accepted

Zombie killers ranking

As a heads up - we have very different formatting styles for our code. Feel free to ignore that difference and don't consider it a comment on your style (unless you prefer mine, in which case please ...
Dan Oberlam's user avatar
  • 7,784
7 votes

NewSequentialId - pure net core 2.2 implementation of sql server function

You want to reduce both computation time and memory allocation. Memory allocation itself takes time, so that's a good place to start -- try to find all the places where you're allocating memory and ...
Jeff's user avatar
  • 850
7 votes

Write SQL Server table to Parquet file

Quick remarks: Your code doesn't follow the coding conventions (camel-case, pascal-case, etc.). string SourceObject_IsTable = args[2]; has a bad name and isn't ...
BCdotWEB's user avatar
  • 11.2k
6 votes
Accepted

Top Python badged users from NYC

Questions First to address some of your questions: Would this sql work with all relational DB's that accept SQL? No, it would not. In fact it's quite unrealistic (if not impossible) to write SQL ...
Phrancis's user avatar
  • 20.4k
6 votes
Accepted

Update user country based on IPv4 decimal address

You process data Row By Agonizing Row instead of a single Update statement. There's no need for temp tables, variables and a loop, simply write a single SELECT and use this in an ...
dnoeth's user avatar
  • 1,172
6 votes
Accepted

Generate SQL for translated resources from Excel Spreadsheet

I'll concentrate on the "pure" Excel part of your code Use fully qualified ranges and avoid Activate/Select statements to avoid unexpected (both form user and code itself) "sheets-jumping" breaking ...
user3598756's user avatar
6 votes
Accepted

Create database connection and run the insert, delete, update queries class

What does the abstract ConnectionManager class buy you ? Nothing, really. The passed-in passedOnConstring is only used for ...
Heslacher's user avatar
  • 50.4k
6 votes

Create database connection and run the insert, delete, update queries class

One note I think you should have: I'm not sure if you realize or not, but readonly doesn't stop the underlying value of the field from changing. It stops ...
Der Kommissar's user avatar
6 votes

T-SQL UDF to replace replace base URLs

Your code looping over string functions doesn't seem like something SQL Server is optimized for. Database systems are optimized for set based operations, not looping. I understand the confusion ...
Tom V's user avatar
  • 161
6 votes
Accepted

Prompting user for connection parameters to SQL Server

It doesn't matter what you do with this code, the ConnectionString can always be accessed in the SqlConnection. As a test, here'...
Der Kommissar's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible