ASP.NET - in a text box i want to see the exisist data from db using web service

Asked By Praveen Mathi on 20-Nov-13 12:36 AM
if i type the first letter of the word in a text box i want get the related datas from db like google search window... now am using the below code in my web service page
 
[WebMethod]

        public string[] CheckSupplierCode(string SUP)
        {
    


            List<string> items = new List<string>(50);
            try
            {
                DataSet dt = new DataSet();
                string constr = ConfigurationManager.ConnectionStrings["SQL1"].ConnectionString;
                OracleConnection con;
                OracleCommand com;
                OracleDataAdapter da = new OracleDataAdapter();
                con = new OracleConnection(constr);
                con.Open();
                com = new OracleCommand("select * from ssp_suppliermaster where SUPCD like '" + SUP + "%'", con);
                OracleDataReader dr;
                dr = com.ExecuteReader();
                da.SelectCommand = com;
                da.Fill(dt);
                for (int i = 0; i < dt.Tables[0].Rows.Count; i++)
                {
                    //items.Add(dt.Tables[0].Rows[i][0].ToString());
                    Random random = new Random();
                    int c1 = (char)random.Next(10, 15);
                    int c2 = (char)random.Next(10, 10);
                    int c3 = (char)random.Next(10, 10);

                    //items.Add(prefixText + c1 + c2 + c3);
                }
            }
            catch (Exception ex)
            {
                items = null;
            }
            return items.ToArray();

        }


Robbe Morris replied to Praveen Mathi on 20-Nov-13 08:33 AM
You need to learn about SQL Injection attacks.  This code is wide open to them.  Also, you do not have to convert the List<string> to an array to work with it in JavaScript
Praveen Mathi replied to Robbe Morris on 21-Nov-13 02:31 AM
thank you  morris, i have done it by aspx coding