I was writing some ADO.NET data access code the other day and something stirred in the memory banks about a similar disaster to what I’m talking about in this post that happened years ago. I couldn’t remember exactly the circumstances of the original disaster but it prompted me to warn my team about it.
Consider the following code:
|
1 2 3 4 5 6 7 8 9 10 11 |
public void DeleteMyStuff(string myKey) { var connectionString = ConfigurationManager.ConnectionStrings["MyConnString"]; using (var con = new SqlClient.SqlConnection(connectionString) { con.Open; var sql = "DELETE FROM MyTable WHERE MyKey = MyKey"; using (var cmd = new SqlClient.SqlCommand(sql,con)) { cmd.Parameters.AddWithValue("@MyKey",myKey); cmd.ExecuteNonQuery(); } } |
Can you spot the mistake?
If I told you that this mistake will result in all the records in the table being deleted and you look again, can you spot it?
Can you spot the mistake in this code?
|
1 2 3 4 5 6 7 8 9 10 11 |
public void DeleteMyStuff(string myKey) { var connectionString = ConfigurationManager.ConnectionStrings["MyConnString"]; using (var con = new SqlClient.SqlConnection(connectionString) { con.Open; var sql = "DELETE FROM MyTable WHERE @MyKey = @MyKey"; using (var cmd = new SqlClient.SqlCommand(sql,con)) { cmd.Parameters.AddWithValue("@MyKey",myKey); cmd.ExecuteNonQuery(); } } |
The problem is the MyKey = MyKey or @MyKey = @MyKey should read MyKey = @MyKey. It just struck me that if you make a single character typo when writing this code, the end result would be to delete all the records in the table. In development shops that develop on shared test or live databases (one of my customers does, despite my continued protests), this can easily lead to disaster.
I’d be interested to know how many people spotted it on first read, especially if you weren’t previously aware of this type of thing. Our brains tend to read what we expect to see, rather than what’s actually there, for example repeating a word in a sentence isn’t always obvious for the same reason.
Leave a Reply