Monday, April 15, 2013

Hide Null value hyperlink Gridview

Visible ='<%# Eval("a") == System.DbNull.Value ? False : True %>'

Here On visible we check if the value is null then visible false otherwise it is true means visible.

Wednesday, April 10, 2013

Gallery Image Zoom

<head>

<title>jQuery Zoom Image on Mouse Hover using jQuery Image Zoom Plugin</title>

#gallery_01 img{border:2px solid white;width: 96px;}

.active img{border:2px solid #333 !important;}

</style>

</head>

<body>

<div>

<a href="#" class="active" data-image="images/small/image1.png"

data-zoom-image="images/large/image1.jpg">

</div>

$(document).ready(function() {

$("#img1").elevateZoom({ gallery: 'gallery_01', cursor: 'pointer', galleryActiveClass: "active" });

$("#img1").bind("click", function(e) {

var ez = $('#img1').data('elevateZoom');

ez.closeAll();

$.fancybox(ez.getGalleryList());

return false;

});

</script>

</body>

</html>

Dowlload Code

Sql Injection just like a solving the puzzle for this we need little bit understanding of sql.

Basically when we use Select Clause to retrieve record from database or while insert record sql injection applied.

Example For Login Query

Select * from Empdetail where EmailID='perfect.chourasia@gmail.com' and pwd='1a2s3d'

Above query return the result where email id and password match by result set.

By Few User can access without any Emailid and Pwd
Use 'OR''=' ,'OR''='--, 'OR''=', 'OR'1'='1 in place of Perfect.chourasia@gmail.com.

Query will break -

Select * from Empdetail where EmailID=''OR''='--' and pwd='1a2s3d'

Say you have a stored procedure that executes dynamic SQL from a user input. A very simple example:

CREATE PROCEDURE dbo.sp_testproc
    @query    varchar(1000)
AS

DECLARE @sql varchar(1000);
SET @sql='SELECT * FROM dbo.Employees WHERE '+@query;
EXEC(@sql);

Needless to say, it is really dangerous to allow people to insert ad-hoc SQL code. Here’s what could happen:

EXECUTE dbo.sp_testproc
    @query='currentlyEmployed=1; DELETE FROM dbo.Employees';

In the example above, the user can wipe the dbo.Employees table because he uses a semicolon to separate a statement into two. Actually, a line break would do just as well.

Replacing semicolons, etc

As a step in validating user-input, you can use the REPLACE() function to eliminate characters or strings in the user input variable.

SET @query=REPLACE(@query, ';', '');
SET @query=REPLACE(@query, CHAR(10), '');
SET @query=REPLACE(@query, CHAR(13), '');

Escaping apostrophes

Apostrophees can be used for a similar purpose when generating SQL injections. You can provide apostrophes in regular text strings in T-SQL, but they are escaped with another apostrophe.

SET @query=REPLACE(@query, '''', '''''');

This may look tricky at first, but remember that an escaped apostrophe is actually two apostrophes when in a string. So to set a variable to the value “Life’s good”, you’d use the following T-SQL

SET @status='Life''s good';

Due to or condition query check the condition ''='' it return true. So hacker succeeded in there aim.

Zoom Image

Jquery Image Zoom On Mousehover

Here you need to place three dimension of single image

a. Thumbnail - 100 x 67 pixels

b. Small - 411 x 274 pixels

c. Large - 1280 x 854 pixels

<%@ Page Language="C#" AutoEventWireup="true" CodeFile="BasicExample.aspx.cs" Inherits="BasicExample" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
    <title>jQuery inner Zoom Image on Mouse Hover</title>
    <script type="text/javascript" src="http://code.jquery.com/jquery-1.8.2.js"></script>
<script src="js/jquery.elevatezoom.min.js" type="text/javascript"></script>
</head>
<body>
    <div>
    <img id="img1" src="images/small/image1.png" data-zoom-image="images/large/image1.jpg"/>

     <img id="img2" src="images/small/image2.png" data-zoom-image="images/large/image2.jpg"/>
    </div>
     <script type="text/javascript">
         $(function() {
         $("#img1").elevateZoom({
             zoomType:"inner",
             cursor:"crosshair"
             });

         });
</script>
</body>
</html>

Download the Code

Tuesday, April 9, 2013

Resizable Gridview

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head id="Head1" runat="server">
    <title></title>
    <script src="Scripts/jquery.js" type="text/javascript"></script>
<script src="Scripts/colResizable-1.3.min.js" type="text/javascript"></script>
<script src="Scripts/jquery.cookie.js" type="text/javascript"></script>
<script type="text/javascript">
     $(document).ready(function () {
         if ($.cookie('colWidth') != null) {
             var columns = $.cookie('colWidth').split(',');
             var i = 0;
             $('.GridViewStyle th').each(function () {
                 $(this).width(columns[i++]);
             });
         }

         $(".GridViewStyle").colResizable({
             liveDrag: true,
             gripInnerHtml: "<div class='grip'></div>",
             draggingClass: "dragging",
             onResize: onSampleResized
         });

     });

     var onSampleResized = function (e) {
         var columns = $(e.currentTarget).find("th");
         var msg = "";
         columns.each(function () { msg += $(this).width() + ","; })
         $.cookie("colWidth", msg);
     };
</script>
</head>
<body>
    <form id="Form1" runat="server">
    <asp:Label ID="Label1" runat="server"></asp:Label>
    <br /> <br />
    <asp:GridView ID="GridView1" runat="server" CssClass="GridViewStyle">
    </asp:GridView>
    <br /><br />
     <asp:Button ID="Button1" runat="server" Text="Test Postback" />

     </form>
</body>
</html>

Code behind page

protected void Page_Load(object sender, System.EventArgs e)
    {
        Dictionary<string, int> col = new Dictionary<string, int>();
        col.Add("key 1", 1);
        col.Add("key 2", 2);
        col.Add("key 3", 3);
        col.Add("key 4", 4);
        col.Add("key 5", 5);
        GridView1.DataSource = col;
        GridView1.DataBind();
    }
    protected void Button1_Click(object sender, System.EventArgs e)
    {
        Label1.Text = string.Format("Current Time is {0}", DateTime.Now.ToString());
    }

Download the Source Code