Elysian Shadows

Code: Select all

//UNSAFE (String Concatenation) query.  Necessary for backward compatibility with the old system
//which stores the query and uses it while querying the ticket list
//Warning: Dynamic queries are UNSAFE and prone to SQL injection!! This should really be fixed..
//==========================================================
query += value;
//==========================================================

//SAFE (Parameterized) query not used due to compatibility issues :(
//==========================================================
//query += "@Value" + row.Index;

//SqlParameter param = new SqlParameter();
//param.ParameterName = "@Value" + row.Index;
//param.Value += value;
//cmd.Parameters.Add(param);
//==========================================================