InstantForum.NET v2.9.0SQLServerCentralhttp://www.sqlservercentral.com/Forums/notifications@sqlservercentral.comThu, 23 May 2013 03:31:32 GMT20http://www.sqlservercentral.com/Forums/Topic1353252-1292-1.aspxThanks for the tip.Security is something I was planning to tackle at a later stage when I'd got the bulk of my functionality working. I realise that'll mean changing a lot of my code, but I'm trying to take things one step at a time. Most of queries are in the VB end too, which I know I'll need to transform into stored procedures sooner or later.Fun times ahead I think!Tue, 04 Sep 2012 13:07:53 GMTsimonwestbhttp://www.sqlservercentral.com/Forums/Topic1353252-1292-1.aspx[quote][b]simonwestb (9/3/2012)[/b][hr]Excellent! That's exactly what I needed. Thank you.[/quote]Now all you have to do is to make sure no one can pull any SQL Injection on you. And, yeah... there are [font="Arial Black"][i]LOTS [/i][/font]of articles on that subject because so many people have been nailed by it on things just like this.I can help avoid SQL Injection on the comma delimited string of numbers but what goes into "CLocation.Text"? And, yeah... I'm strongly recommending that you DON'T use that code until you make it bullet proof. It's just waiting to be attacked.Mon, 03 Sep 2012 20:10:44 GMTJeff Modenhttp://www.sqlservercentral.com/Forums/Topic1353252-1292-1.aspxExcellent! That's exactly what I needed. Thank you.Mon, 03 Sep 2012 12:34:00 GMTsimonwestbhttp://www.sqlservercentral.com/Forums/Topic1353252-1292-1.aspx[quote][b]simonwestb (9/2/2012)[/b][hr]Hi,I wasn't sure how to phrase my query so wasn't sure what to search for.I'm attempting the simplest of updates - e.g. "UPDATE CRnumbers SET StudyLocationID = " + CLocation.Text + " WHERE RegNumber = "+UserEntry.textUserEntry might be '12345', but how do I update for multiple entries?So if UserEntry has '12345,12347,12399' my super-newbie method would be to separate the comma separated values and loop through each one updating each individually, but this is obviously not the way to go.How do I structure my SQL to update all 3 of those values in one hit? Do I create a table from my CSVs and use that somehow or is there a simple command that understands multiple values like that?Thanks in advance, folks.[/quote]There is a simple "command"[code="other"]"UPDATE CRnumbers SET StudyLocationID = " + CLocation.Text + " WHERE RegNumber IN ( "+UserEntry.text + ")"[/code]Mon, 03 Sep 2012 07:24:48 GMTEugene Elutinhttp://www.sqlservercentral.com/Forums/Topic1353252-1292-1.aspxSorry, yes (and thanks for replying).CLocation.text is just a single value.Mon, 03 Sep 2012 06:09:36 GMTsimonwestbhttp://www.sqlservercentral.com/Forums/Topic1353252-1292-1.aspxYou didn't say what's in CLocation.Text. Is that also a delimited string with the same number of values? Or perhaps just a single value? Or some combination?Sun, 02 Sep 2012 20:10:12 GMTdwain.chttp://www.sqlservercentral.com/Forums/Topic1353252-1292-1.aspxHi,I wasn't sure how to phrase my query so wasn't sure what to search for.I'm attempting the simplest of updates - e.g. "UPDATE CRnumbers SET StudyLocationID = " + CLocation.Text + " WHERE RegNumber = "+UserEntry.textUserEntry might be '12345', but how do I update for multiple entries?So if UserEntry has '12345,12347,12399' my super-newbie method would be to separate the comma separated values and loop through each one updating each individually, but this is obviously not the way to go.How do I structure my SQL to update all 3 of those values in one hit? Do I create a table from my CSVs and use that somehow or is there a simple command that understands multiple values like that?Thanks in advance, folks.Sun, 02 Sep 2012 11:12:29 GMTsimonwestb