Can't retrieve data with dot symbol from sql database - sql

Question

In my project (vb.net) I store the ip address of a website in a table with column of type nvarchar. But I can't retrieve it from the table. I wonder if its a problem with "dot" symbol. Please help.
This is the command that I use
query = "select *from restricted_sites where site_address='" + webip + "'"
webip is the ip address of web site.
Imports System.Data.SqlClient
Imports System.Net
Public Class restrict
Private Sub clear_button_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles clear_button.Click
site_TextBox1.Text = ""
addr_TextBox1.Text = ""
End Sub
Private Sub submit_button_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles submit_button.Click
Dim connectionstr As String
Dim query As String
Dim conn As SqlConnection
Dim cmd As SqlCommand
Dim webip As String
Dim hostname As IPHostEntry = Dns.GetHostByName(addr_TextBox1.Text)
Dim ip As IPAddress() = hostname.AddressList
Try
webip = ip(0).ToString
connectionstr = "Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\DATA\URLTrack.mdf;Integrated Security=True;Connect Timeout=30;User Instance=True"
conn = New SqlConnection(connectionstr)
conn.Open()
query = "insert into restricted_sites values('" + site_TextBox1.Text + "','" + webip + "')"
cmd = New SqlCommand(query, conn)
cmd.ExecuteNonQuery()
MsgBox("Website added for restriction", MsgBoxStyle.Information)
conn.Close()
Catch ex As SqlException
End Try
End Sub
End Class
Private Sub Combox1_KeyPress(ByVal sender As System.Object, ByVal e As System.Windows.Forms.KeyPressEventArgs) Handles Combox1.KeyPress
If e.KeyChar = Convert.ToChar(Keys.Enter) Then
Dim connectionstr As String
Dim query As String
Dim cmd As SqlCommand
Dim reader As SqlDataReader
Dim conn As SqlConnection
Dim url As String = ""
Dim webip As String
Dim hostname As IPHostEntry = Dns.GetHostByName(Combox1.Text)
Dim ip As IPAddress() = hostname.AddressList
webip = ip(0).ToString
connectionstr = "Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\DATA\URLTrack.mdf;Integrated Security=True;Connect Timeout=30;User Instance=True"
conn = New SqlConnection(connectionstr)
conn.Open()
query = "select * from restricted_sites where site_address='" + webip + "'"
cmd = New SqlCommand(query, conn)
reader = cmd.ExecuteReader
While (reader.Read())
url = reader(2)
End While
reader.Close()
MsgBox(url, MsgBoxStyle.Information)
If webip <> url Then
AxWebBrowser1.Navigate(Combox1.Text)
Combox1.Text = AxWebBrowser1.LocationURL
Else
MsgBox("This Web Page is Restricted.Contact the ADMIN for Further Info", MsgBoxStyle.Critical)
End If
End If
If e.KeyChar = Convert.ToChar(Keys.Escape) Then
AxWebBrowser1.Stop()
End If
End Sub
The second code is the comparing part.
query = "select * from restricted_sites where site_address='" + webip + "'"
this code is the problem.
This is my code for restricting web sites through matching with ip address stored in database,when the url is being navigated.

Answer 1

You have a syntax error on your query. you forgot the space between * and from.
select *from restricted_sites
^ here
it should be
select * from restricted_sites
side note, since you are using VBNet, please do parameterized your query by using adonet command and parameters as your current query is susceptible with SQL Injection.

Answer 2

You need to put a space between the * and the from like so:
query = "select * from restricted_sites where site_address='" + webip + "'"
Dot symbols (presumably you meant in the webip) won't be a problem because it is in a String

Answer 3

If all you are doing is checking if an IP address string is in the database, you only need to count the number of occurences of that string:
query = "SELECT COUNT(*) FROM restricted_sites WHERE site_address = #WebIp;"
cmd = New SqlCommand(query, conn)
' assumes the ip address column is 15 chars '
cmd.Parameters.Add(New SqlParameter With {.ParameterName = "#WebIp", _
.SqlDbType = SqlDbType.NVarChar, _
.Size = 15, _
.Value = webip})
conn.Open()
Dim nFound = CInt(cmd.ExecuteScalar)
conn.Close()
If nFound = 0 Then
' site is not in restricted list
End If
Also, you should not use SELECT * in code other than for testing - use the column names instead of * and only retrieve what you need.