Question

I have a windows form application which interacts with a remote database. the database contains 2 tables.

A user can type date into MaskedTextBox and then update record by clicking button and issuing the statment. However its annoying using the maskedtextbox since the MySQL Date columns take the format YYYY-MM-DD. So the user must enter for example 2010-11-15 into the masked text box for it to work (this works, but its not so intuitive to enter into this format). I want to use a DateTimePicker instead, but since this controls “text” property gives the format DD-MM-YYYY, when I cast to string it looks like 15-11-2010. The MySQL obviously doesnt process this correctly.

What is the best way handle this, should I parse the 3 sets of numbers (day, month, year) from Datetimepicker.text? or is ther a way to change the actual format the MySQL date takes? Or could I edit the SQL statment so that I change the format of the return date?

Here is the sql statment I am using in case its of any use:

commandinsert.CommandText = "insert into jobs (id,date) values ('" + comboBox1.Text + "','" + maskedTextBox1.Text + "')";

Thanks in advance.

Answer 1

You should pass the texts using parameters.
You can then pass the DateTimePicker’s SelectedDate property directly as a parameter, and the MySQL client will send the correct data.

This will also prevent a SQL injection attack.

For more information, see here