Question

SqlDataReader myreader;
myreader = cmmd.ExecuteReader();

                        StringBuilder sb = new StringBuilder();
                        sb.Append("<b>Vaccine</b>&nbsp;&nbsp;&nbsp;<b> Vaccination Date</b>&nbsp;&nbsp;&nbsp;<b> Vaccination Due Date</b>&nbsp;&nbsp;&nbsp;<b> Incomplete Vaccination </b>&nbsp;&nbsp;&nbsp;<b>Dose No.</b>&nbsp;&nbsp;&nbsp;<b> Remarks </b><br/><br/>");
                        while (myreader.Read())
                            {
                                    sb.Append(myreader["VaccineID"]);
                                    sb.Append("&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;");
                                    sb.Append(myreader["DateOFVaccine"]);
                                    sb.Append("&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;");
                                    sb.Append(myreader["NextVaccinationDueDate"]);
                                    sb.Append("&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;");
                                    sb.Append(myreader["AnyIncompleteImmunization"]);
                                    sb.Append("&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;");
                                    sb.Append(myreader["DoseNumber"]);
                                    sb.Append("&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;");
                                    sb.Append(myreader["Remark1"]);
                                    sb.Append("<br/>");
                            }
                        lblDisplayDetails.Text = sb.ToString();
                        myreader.Close();

WHAT EXACTLY I WANT IS TO RETRIEVE DATA(may be from separate table) AND THEN DISPLAY THEM PUTTING SOME STYLE(font,color etc).

Is retrieving from multiple table is possible in gridview ? I could use the DataReader, but how to display them in style(font,color etc) ?
Regards
Indranil

Answer 1

You need to use the Literal control, and since your string contains html tags, you’ll need to set the control’s Mode to PassThrough

This is a very dangerous thing to do, because if a hacker or even a digruntled user somehow gets the string <script>alert('haha i hacked your site')</script> into any of your database cells, such as “Remark1”, then you’ve just fallen victim to an XSS attack

You’ll need to call Server.HtmlEncode on all of your myreader fields:

sb.Append(Server.HtmlEncode(myreader["Remark1"]));

like this page recommends: http://msdn.microsoft.com/en-us/library/a2a4yykt.aspx