tags:

views:

107

answers:

5

I have a SQL database that creates a record for every document uploaded by the user to the server. I want to check this table before a user uploads a document to ensure they don't upload a file with name that already exists.

I know how to make the connection and make the SqlCommand to query the table for an existing record. But I don't know how to check the record count from the sqlCommand I made.

Does that make sense?

Using myConnectionCheck As New SqlConnection(myConnectionStringCheck)
                Dim myCommandCheck As New SqlCommand()
                myCommandCheck.Connection = myConnectionCheck
                myCommandCheck.CommandText = "SELECT * FROM Req_Docs WHERE Doc_Name =" & DocName
                myConnectionCheck.Open()
                myCommandCheck.ExecuteNonQuery()

            End Using

Thanks in advance,

Anthony

+2  A: 

use if exists for this issue

create procedure isDocExists
@DocName varchar(255),
@isExists bit output
as
    set @isExists = 0
    if exists (SELECT Doc_Name FROM Req_Docs WHERE Doc_Name =@DocName)
    begin
           set @isExists=1
    end

to check where record is there or not

Pranay Rana
+1 for IF EXISTS(). Only caveat would be to change SELECT * to SELECT Doc_Name so that query only needs to grab one column. Could be considered nit picky, but the SQL folks will tell you SELECT * shouldn't be used unless necessary for performance reasons.
Dillie-O
yes you are right query is updated now thanks for the infomation
Pranay Rana
+1  A: 

ExecuteNonQuery is a function, that returns an integer equal to the number of rows affected by the query.

However, it's usually used for updates.

You might consider ExecuteScalar, which returns the first column of the first row in the result set.

So if you change the query to select count(*) from..., the result of ExecuteScalar will be the number of rows, which you can then test.

ChrisA
A: 

if you want count:

SELECT COUNT(*) as count FROM Req_Docs WHERE Doc_Name = 'DocName'
praksant
better to use IF EXISTS() - that'll stop once it finds the first match, while the COUNT(*) will scan the whole table......
marc_s
maybe in the WHERE statement there could be LIMIT 1 and it might work with similar complexity :)
praksant
+1  A: 

So many things wrong here:

  • Race condition between when you check and when you upload
  • Multiple Documents should legitimately be allowed to have the same name. Use tags, folders, timestamps, or other means to distinguish them.
  • Sql Injection vulnerability on the name parameter
  • ExecuteNonQuery() on a SELECT query.

I'll give you the benefit of the doubt on the first two points that you're still gonna allow the upload, and this is just so you can ask the user how they want to relate the documents. Given that, here's how you fix the other two:

Using cn As New SqlConnection(myConnectionStringCheck), _
      cmd As New SqlCommand("SELECT COUNT(*) FROM (SELECT TOP 1 1 FROM Req_Docs WHERE Doc_Name= @DocName) t", cn)
    cmd.Parameters.Add("@DocName", SqlDbTypes.VarChar, 255).Value = DocName

    cn.Open()
    Return CInt(cmd.ExecuteScalar())
End Using
Joel Coehoorn
A: 

Chris A I used your solution. Thanks.

Anthony
ChrisA