Concept Framework 1.0 documentation Contents | Index

ADODataSet.PreparedQuery

Name Type Access Version Deprecated
PreparedQuery property public version 1.0 no

Prototype:
Read/Write property PreparedQuery[=szQuery]


Description:
This property is very similar to the CommandText property, but it takes parameters (for large objects for example). Each parameter in the SQL prepared query must contain a question mark '?' instead of the actual parameter. For example "select * from my_table where my_field like 'some_text'" will become "select * from my_table where my_field like ?" (no quotes). But BEFORE of that, you must call AddParameter function to add parameters to the prepared SQL query.

This method is recommended over the CommandText version for:
- inserting data into a table (in case the user is an attacker)
- adding data to a table, where at least one field is inserted by the user (in case the user is an attacker)
- performing a search (select), where at least one criteria is inserted directly by the user (in case the user is an attacker)
- working with large fields (LOB)

If no parameter is provided, this property acts exactly like CommandText.

Returns:
Returns the prepared parameterized query if any.

Documented by Eduard Suica, generation time: Thu Oct 15 20:01:57 2009 GMT(c)2009 RadGs Software