70-561 Free Dumps Study Materials
Question 13: You create an application by using the Microsoft .NET Framework 3.5 and Microsoft ADO.NET.
The application contains a TextBox control named txtProductID. The application will return a list of active
products that have the ProductID field equal to the txtProductID.Text property.
You write the following code segment. (Line numbers are included for reference only.)
01 Private Function GetProducts(ByVal cn _
As SqlConnection) As DataSet
02 Dim cmd As New SqlCommand()
03 cmd.Connection = cn
04 Dim da As New SqlDataAdapter(cmd)
05 Dim ds As New DataSet()
06
07 da.Fill(ds)
08 Return ds
09 End Function
You need to populate the DataSet object with product records while avoiding possible SQL injection
attacks.
Which code segment should you insert at line 06?
A. cmd.CommandText = _
String.Format("sp_sqlexec 'SELECT ProductID, " + _
"Name FROM Product WHERE ProductID={0} AND IsActive=1'", _
txtProductID.Text)
B. cmd.CommandText = _
String.Format("SELECT ProductID, " + _
"Name FROM Product WHERE ProductID={0} AND IsActive=1", _
txtProductID.Text)
cmd.Prepare()
C. cmd.CommandText = _
String.Format("SELECT ProductID, " + _
"Name FROM Product WHERE ProductID={0} AND IsActive=1", _
txtProductID.Text)
cmd.CommandType = CommandType.TableDirect
D. cmd.CommandText = "SELECT ProductID, " + _
"Name FROM Product WHERE ProductID=@productID AND IsActive=1"
cmd.Parameters.AddWithValue("@productID", txtProductID.Text)
Correct Answer: D