the stevie eXPerience 3.0

third time lucky!
posts - 31, comments - 26, trackbacks - 1

data grids, data sets, data data everywhere

I just had my first real experience with the DataGrid ASP.NET control, and I thought this might be a good chance to go over some of the basics I've learned.

Basically I was asked to design and implement a web form that would allow easy searching of a particular view of the database. The search was to be based on any of the column headers. Grand so. I was also told that the easiest way (actually, the only feasible way) to do this was to implement a DataGrid. Now not knowing much about DataGrids, I launched into it with my usual aplomb.

My first thought was to use a SqlDataReader object to read the data from the DB (simply because I had just come off a VERY long project where data readers were used almost exclusively). Using this idea, I came up with the following method:

                
                private
                
                void
                 Initialise_DataGrid1(){    
                string
                 strConnectionString 
                =
                 GetConnectionString();    SqlConnection objConnection 
                =
                
                new
                 SqlConnection(strConnectionString);    
                string
                 strCommand 
                =
                
                "
                SELECT * FROM some_table WHERE some_field LIKE '%
                "
                
                +
                         TextBox1.Text.Replace(
                "
                '
                "
                ,
                "
                ''
                "
                ) 
                +
                
                "
                %'
                "
                ;    SqlCommand objCommand 
                =
                
                new
                 SqlCommand(strCommand,objConnection);    objConnection.Open();    SqlDataReader objReader 
                =
                 objCommand.ExecuteReader();    DataGrid1.DataSource 
                =
                 objReader;    DataGrid1.DataBind();    objConnection.Close();      }
              

This worked fine and dandy until I was asked to make it so that the DataGrid could "page", ie could move from page one to page two to page three etc. No problem I thought, I'll just change the AllowPaging property of the DataGrid to True and hey pres... uh-oh. I just got the dreaded Yellow and Red ASP.NET error page.

Server Error in '/SomeApplication' Application.
AllowCustomPaging must be true and VirtualItemCount must be set for a DataGrid with ID DataGrid1 when AllowPaging is set to true and the selected datasource does not implement ICollection

Ok, no problem. I'll just change AllowCustomPaging to True and set VirtualItemCount to some arbitary number and see what happens... ah.

Nothing happend. Damn and blast! The paging arrows are there, but they are not doing anything. Right so, back to the drawing board.

It was at this point that I was reading this book and discovered the answer... Ahhh, I should use a DataSet as the DataSource for my DataGrid if I want to use paging. Well why didn't ya say so?! So the method was redesigned and I came up with:

                
                private
                
                void
                 Initialise_DataGrid1(){    
                string
                 strConnectionString 
                =
                 GetConnectionString();    SqlConnection objConnection 
                =
                
                new
                 SqlConnection(strConnectionString);    
                string
                 strCommand 
                =
                
                "
                SELECT * FROM some_table WHERE some_field LIKE '%
                "
                
                +
                         TextBox1.Text.Replace(
                "
                '
                "
                ,
                "
                ''
                "
                ) 
                +
                
                "
                %'
                "
                ;    objConnection.Open();        SqlDataAdapter objAdapter 
                =
                
                new
                 SqlDataAdapter(strCommand,objConnection);    DataSet objDataSet 
                =
                
                new
                 DataSet();    objAdapter.Fill(objDataSet);    DataGrid1.DataSource 
                =
                 objDataSet;    DataGrid1.DataBind();    objConnection.Close();      }
              

This worked better but it still didn't progress the page. When I clicked the "forwards" arrow, it just reloaded the same page. It turns out that you got to write the event handler yourself. Hence:

                
                private
                
                void
                 InitializeComponent(){        
                this
                .DataGrid1.SortCommand 
                +=
                
                new
                 System.Web.UI.WebControls.DataGridSortCommandEventHandler(                                                                    
                this
                .DataGrid1_SortCommand);    
                this
                .Load 
                +=
                
                new
                 System.EventHandler(
                this
                .Page_Load);}
                private
                
                void
                 DataGrid1_PageIndexChanged(
                object
                 source, DataGridPageChangedEventArgs e){    DataGrid1.CurrentPageIndex 
                =
                 e.NewPageIndex;    Initialise_DataGrid1();}
              

And it works! Yay!

posted on Wednesday, July 06, 2005 3:04 PM

Feedback

#   re: data grids, data sets, data data everywhere

Hey Stevie, welcome to our community!
I know it is not the main focus of this post, but I just noticed that the examples compose the query by concatenating strings.
This (unfortunately common) practice can be very dangerous as it might potentially expose the system to SQL injection attacks. In this particular example, the "replace quote" trick happens to be just fine in SQL Server (it easy to break it in MySql), however it would open a huge security hole if, for example, the query expected a numeric value.
It is commonly accepted that a better way to prevent this problem is to use parameterized queries instead.
Our common friend, Brian, wrote a couple of posts where he provides useful links that analyze the issue and offer ways to prevent it ( http://briandela.com/blog/archive/2005/07/07/706.aspx ).
Please forgive me if you feel that this comment is unnecessary...
Better be safe than sorry!
7/10/2005 12:35 PM | Claudio Perrone

#   re: data grids, data sets, data data everywhere

Comments are always appreciated! Cheers!
7/11/2005 9:31 AM | Stevie
Post a new comment about this topic
Title  
Name  
Url

Comments  
Enter the code you see: