Sqlparameter is already contained by another Sqlparameter Collection

"Sqlparameter is already contained by another Sqlparameter Collection" --This

is the problem I faced last week while I created two SqlCommand. First one, to

find the variable Id 'a' and second one pass that 'a' to the stored procedure.

The solution, I added the SqlCommand.Parameters.Clear() to the code and the problem gone.

As you can in the code, I created SqlCommand Command and should be destroyed at the end because

C# is the managed language that handles garbage collections.

Code example:

SqlConnection conn =

new SqlConnection(DataAccess.GetConnectionString());

string strSQLCommand =

"select Id from Schools WHERE SchoolName= '" + name + "'";

SqlCommand command =

new SqlCommand(strSQLCommand, conn);

int a = Convert.ToInt32(command.ExecuteScalar());

//write this line of code before using another command execute function

command.Parameters.Clear();

...................................................

...................................................

SqlDataReader rdr = null;

SqlCommand cmd = new SqlCommand("dbo.GetSchoolName", conn);

cmd.CommandType = CommandType.StoredProcedure;

cmd.Parameters.Add("@ID", SqlDbType.Int).Value = a;

rdr = cmd.ExecuteReader();

...................................................

...................................................

Happy Coding !!!

A potentially dangerous Request.Form value was detected from the client

I had a run time error on my web application last week . It was a request form application whichhas user input testboxes. When I looked into event viewer on the server, the actual problem was:

A Potentially dangerous Request.Form value was detected from the client.

Basically it means that you can't post values containing HTML ( or script ) tags to the server.

In other words - if you have a textbox and the visitor enters something like :

and then presses Submit button this error will occur since the posted value(s) contains HTML tags.

There are different solutions to solve thhis problem, you can read more at ASP.Net site. Many People suggests changing web.config file which is a bad solutions since it'll affect all pages on your Site.

The simple solution is add a tag validateRequest="false" into the Page-directive on top of the page. When request validation is disabled, content can be submitted to a page but developer should ensure that content is properly encoded or processed.

Happy Programming!!

Paramaterized Queries.

Parameterized queries prohibit the sql injection in your web application.

It allows you to safely write code like the following:

Let say, I have a SqlDataReader function to get the details of the particular ID:

public static SqlDataReader GetDetail(int id)

{

string sql = "select * from Raj_table where id = @id ";

SqlParameter paramUserId = new SqlParameter("id", SqlDbType.Int);

paramUserId.Value = id;

// I like to use the SqlHelper class

return SqlHelper.ExecuteReader(GetConnectionString(), CommandType.Text, sql, paramUserId);

}

Firstly, this parameter ensures that the paramater is an INT so a string value would throw an exception here. Also, if we were using a VARCHAR parameter, the SqlParameter value assignment automatically escapes the string for us.

If you run SQL Profiler and observe the queries, you'll notice that they are actually execute via a Stored Procedure (sp_executesql)

Happy Programming!!

Sending Email with ASP.NET

Email consists:

-From

-To

-CC

-BCC

-Subect

-Body

depend on these fields, below is the ASP.NET code to send the message:

First, add this namespace 'using System.Web.Mail' to your aspx.cs page.

then inside the button_click event, add this code:

MailMessage mail = new MailMessage();

mail.From = "someone@google.com";

mail.To = "somebody@google.com";

mail.Cc = "badgirl@google.com";

mail.Subject = "Just to say hi";

mail.Bcc = "badboy@google.com";

mail.Body = "Happy B'day to you!!";

//If you are using different mail server, please replace this one by your own...

SmtpMail.SmtpServer = "smtp.gmail.com";

SmtpMail.Send(mail);

Sending Attachments:

mail.From = "someone@google.com";

mail.To = "somebody@google.com";

mail.Cc = "badgirl@google.com";

mail.Subject = "Just to say hi";

mail.Bcc = "badboy@google.com";

mail.Body = "Happy B'day to you!!";

mail.BodyFormat = MailFormat.Text;

mail.Attachments.Add(new MailAttachment("c:\\temp\\test.pdf"));

SmtpMail.SmtpServer = "smtp.gmail.com";

SmtpMail.Send(mail);

Happy Coding!!!