Text is not a member of System.Web.UI.WebControls.DropDownList

Ive got a problem here.
I had a script that took user registration info from a form and added it to a database. I had a few issues with relpacing characters and someone gave my some advice on simplifing my script. Now i am having loads of problems with it.
First of all it is now throwing the error above
'Text' is not a member of 'System.Web.UI.WebControls.DropDownList'
Basically i have a dropdown box with counties in it, oh god this asp.net is killing me
Sorry code dump:

<%@dotnet.itags.org. Import Namespace="System.Data" %>
<%@dotnet.itags.org. Import Namespace="System.Data.OleDb" %>

<script language="VB" runat="server">
Sub btnSubmit_OnClick(Source As Object, E As EventArgs)

If Page.IsValid() Then

Dim sConnection As String
Dim dbConn As OleDb.OleDbConnection
Dim dbCmd As OleDb.OleDbCommand

Dim sqlStatement As String = "INSERT INTO Tblusers ( forename, surname, pass, Email, telephone, mobile, busname, address1, address2, county, postcode ) VALUES (@dotnet.itags.org.forename, @dotnet.itags.org.surname, @dotnet.itags.org.pass, @dotnet.itags.org.email, @dotnet.itags.org.telephone, @dotnet.itags.org.mobile, @dotnet.itags.org.busname, @dotnet.itags.org.address1, @dotnet.itags.org.address2, @dotnet.itags.org.county, @dotnet.itags.org.postcode, , )"

DBCmd.Parameters.Add("@dotnet.itags.org.Forename", TxtForename.Text)
DBCmd.Parameters.Add("@dotnet.itags.org.Surname", TxtSurname.Text)
DBCmd.Parameters.Add("@dotnet.itags.org.Pass", TxtPass.Text)
DBCmd.Parameters.Add("@dotnet.itags.org.Email", TxtEmail.Text)
DBCmd.Parameters.Add("@dotnet.itags.org.Telephone", TxtTelephone.Text)
DBCmd.Parameters.Add("@dotnet.itags.org.Mobile", TxtMobile.Text)
DBCmd.Parameters.Add("@dotnet.itags.org.Busname", TxtBusname.Text)
DBCmd.Parameters.Add("@dotnet.itags.org.Address1", TxtAddress1.Text)
DBCmd.Parameters.Add("@dotnet.itags.org.Address2", TxtAddress2.Text)
DBCmd.Parameters.Add("@dotnet.itags.org.county", Txtcounty.Text)
DBCmd.Parameters.Add("@dotnet.itags.org.postcode", Txtpostcode.Text)
sConnection = "Provider=Microsoft.Jet.OLEDB.4.0; Data Source = " & Server.MapPath("data\classcampers.mdb")
dbConn = New OleDb.OleDbConnection(sConnection)
dbConn.Open()

dbCmd = New OleDb.OleDbCommand(sqlStatement, dbConn)
dbCmd.ExecuteNonQuery()

dbConn.Close()
End If
end sub
and the top of my form
<asp:DropDownList name="txtcounty" class="searchbox" id="txtcounty" runat = "server">
<asp:ListItem id = "Selected" runat = "server" value = "Selected" selected="true">Select a County</asp:ListItem>
<asp:ListItem id = "Aberdeenshire" runat = "server" value = "Aberdeenshire">Aberdeenshire</asp:ListItem>
<asp:ListItem id = "Angus" runat = "server" value = "Angus" >Angus</asp:ListItem>
<asp:ListItem id = "ArgyllBute" runat = "server" value = "ArgyllBute">ArgyllBute</asp:ListItem>
<asp:ListItem id = "Avon" runat = "server" value = "Avon">Avon</asp:ListItem>
<asp:ListItem id = "Bedfordshire" runat = "server" value = "Bedfordshire">Bedfordshire</asp:ListItem>
<asp:ListItem id = "Berkshire" runat = "server" value = "Berkshire">Berkshire</asp:ListItem>
<asp:ListItem id = "BlaenauGwent" runat = "server" value = "BlaenauGwent" >Blaenau Gwent</asp:ListItem>
<asp:ListItem id = "Borders" runat = "server" value = "Borders">Borders</asp:ListItem>
<asp:ListItem id = "Bristol" runat = "server" value = "Bristol">Bristol</asp:ListItem>
<asp:ListItem id = "Buckinghamshire" runat = "server" value = "Buckinghamshire">Buckinghamshire</asp:ListItem>
<asp:ListItem id = "Cambridgeshire" runat = "server" value = "Cambridgeshire">Cambridgeshire</asp:ListItem>
<asp:ListItem id = "Cardiff" runat = "server" value = "Cardiff" >Cardiff</asp:ListItem>
For some reason the error is falling on the"DBCmd.Parameters.Add("@dotnet.itags.org.county", Txtcounty.Text) "
Anyideas would be great
I still cant replace charaters either
Cheers

That's bcause a DropDownList does not have a property called 'Text'

What it DOES have, however is 'SelectedItem.Text' - - substitute that for 'Text', with your dropdownlist designation -
DBCmd.Parameters.Add("@.county", Txtcounty.SelectedItem.Text)

Thanks for your reply and sorry for the massive code dump but i have spend 4 hours on this
Ive got another error now:

Object reference not set to an instance of an object.

Description:An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.
Exception Details:System.NullReferenceException: Object reference not set to an instance of an object.
Line 45: DBCmd.Parameters.Add("@.Forename", TxtForename.Text)
any ideas this is killing me. It worked before and now it doesnt. I think i am going to cry
Paul

tallpaul101 wrote:

Dim sConnection As String
Dim dbConn As OleDb.OleDbConnection
Dim dbCmd As OleDb.OleDbCommand

Dim sqlStatement As String = "INSERT INTO Tblusers ( forename, surname, pass, Email, telephone, mobile, busname, address1, address2, county, postcode ) VALUES (@.forename, @.surname, @.pass, @.email, @.telephone, @.mobile, @.busname, @.address1, @.address2, @.county, @.postcode, , )"

DBCmd.Parameters.Add("@.Forename", TxtForename.Text)
DBCmd.Parameters.Add("@.Surname", TxtSurname.Text)
DBCmd.Parameters.Add("@.Pass", TxtPass.Text)
DBCmd.Parameters.Add("@.Email", TxtEmail.Text)
DBCmd.Parameters.Add("@.Telephone", TxtTelephone.Text)
DBCmd.Parameters.Add("@.Mobile", TxtMobile.Text)
DBCmd.Parameters.Add("@.Busname", TxtBusname.Text)
DBCmd.Parameters.Add("@.Address1", TxtAddress1.Text)
DBCmd.Parameters.Add("@.Address2", TxtAddress2.Text)
DBCmd.Parameters.Add("@.county", Txtcounty.Text)
DBCmd.Parameters.Add("@.postcode", Txtpostcode.Text)

sConnection = "Provider=Microsoft.Jet.OLEDB.4.0; Data Source = " & Server.MapPath("data\classcampers.mdb")
dbConn = New OleDb.OleDbConnection(sConnection)
dbConn.Open()

dbCmd = New OleDb.OleDbCommand(sqlStatement, dbConn)
dbCmd.ExecuteNonQuery()

dbConn.Close()

Ok, there error you are getting tells us that you haven't instantiated a declared variable. In this case it appears to be your OleDBCommand, which you do actually instantiate (in red), but not before trying to add Parameters to it (in green). It appears you just need to repositon some of what you have to be similar to this:

Dim sConnection As String
Dim dbConn As OleDb.OleDbConnection
Dim dbCmd As OleDb.OleDbCommand

Dim sqlStatement As String = "INSERT INTO Tblusers ( forename, surname, pass, Email, telephone, mobile, busname, address1, address2, county, postcode ) VALUES (@.forename, @.surname, @.pass, @.email, @.telephone, @.mobile, @.busname, @.address1, @.address2, @.county, @.postcode, , )"
sConnection = "Provider=Microsoft.Jet.OLEDB.4.0; Data Source = " & Server.MapPath("data\classcampers.mdb")
dbConn = New OleDb.OleDbConnection(sConnection)
dbCmd = New OleDb.OleDbCommand(sqlStatement, dbConn) ' Note: sqlStatement should probably be sConnection
DBCmd.Parameters.Add("@.Forename", TxtForename.Text)
DBCmd.Parameters.Add("@.Surname", TxtSurname.Text)
DBCmd.Parameters.Add("@.Pass", TxtPass.Text)
DBCmd.Parameters.Add("@.Email", TxtEmail.Text)
DBCmd.Parameters.Add("@.Telephone", TxtTelephone.Text)
DBCmd.Parameters.Add("@.Mobile", TxtMobile.Text)
DBCmd.Parameters.Add("@.Busname", TxtBusname.Text)
DBCmd.Parameters.Add("@.Address1", TxtAddress1.Text)
DBCmd.Parameters.Add("@.Address2", TxtAddress2.Text)
DBCmd.Parameters.Add("@.county", Txtcounty.Text)
DBCmd.Parameters.Add("@.postcode", Txtpostcode.Text)
dbConn.Open()
dbCmd.ExecuteNonQuery()
dbConn.Close()
By switching around the location of the instantiation you should remove that error. Basically, you can't add properties (query paramaters in this case) to a non-instantiated non-static object.

Ok have done that. I did try to move things around but with no luck

I have moved on now. I get an error now:

Syntax error in INSERT INTO statement.
if i change:
dbCmd = New OleDb.OleDbCommand(sqlStatement, dbConn) ' Note: sqlStatement should probably be sConnection
to what you have said i get the following error:
Invalid SQL statement; expected 'DELETE', 'INSERT', 'PROCEDURE', 'SELECT', or 'UPDATE'
so i assume that part of it was right. i cant notice anything wrong with the sql statement apart from the fact that i need to strip out spaces in the telephone feild. For now i have just made sure that there are no spaces.
Thanks for your response. This has been killing me
It was working. All i originally wanted to do is strip out any spaces
Thanks Again

I got it
You are a star, thankyou very much
Dont suppose you know why now i have added:
Line 33: DBCmd.Parameters.Add("@.Telephone", TxtTelephone.Text.Replace(" ". ""))
I get the following error

C:\WINDOWS\system32> "c:\windows\microsoft.net\framework\v1.1.4322\vbc.exe" /t:library /utf8output /R:"c:\windows\assembly\gac\system.enterpriseservices\1.0.5000.0__b03f5f7f11d50a3a\system.enterpriseservices.dll" /R:"c:\windows\assembly\gac\system.data\1.0.5000.0__b77a5c561934e089\system.data.dll" /R:"c:\windows\assembly\gac\system.drawing\1.0.5000.0__b03f5f7f11d50a3a\system.drawing.dll" /R:"c:\windows\assembly\gac\system.web.mobile\1.0.5000.0__b03f5f7f11d50a3a\system.web.mobile.dll" /R:"c:\windows\assembly\gac\system.xml\1.0.5000.0__b77a5c561934e089\system.xml.dll" /R:"c:\windows\assembly\gac\system.web.services\1.0.5000.0__b03f5f7f11d50a3a\system.web.services.dll" /R:"c:\windows\assembly\gac\system\1.0.5000.0__b77a5c561934e089\system.dll" /R:"c:\windows\assembly\gac\system.web\1.0.5000.0__b03f5f7f11d50a3a\system.web.dll" /out:"C:\windows\microsoft.net\framework\v1.1.4322\Temporary ASP.NET Files\websites_class campers\a6eadb42\22cf6334\ojbpvgwc.dll" /D:DEBUG=1 /debug+ /win32resource:"C:\windows\microsoft.net\framework\v1.1.4322\Temporary ASP.NET Files\websites_class campers\a6eadb42\22cf6334\ojbpvgwc.res" "C:\windows\microsoft.net\framework\v1.1.4322\Temporary ASP.NET Files\websites_class campers\a6eadb42\22cf6334\ojbpvgwc.0.vb"Microsoft (R) Visual Basic .NET Compiler version 7.10.3052.4for Microsoft (R) .NET Framework version 1.1.4322.573Copyright (C) Microsoft Corporation 1987-2002. All rights reserved.c:\inetpub\wwwroot\Websites\Class Campers\UserRegistration.aspx(33) : error BC30203: Identifier expected. DBCmd.Parameters.Add("@.Telephone", TxtTelephone.Text.Replace(" ". "")) ~~

Cheers anyway
Paul
Take out Text. I practiced what you ahve there with a string of numbers and then replaced and printed to the screen. Error I got was that Text is not a property of String.
DBCmd.Parameters.Add("@.Telephone", TxtTelephone.Text.Replace(" ". ""))
Should be
DBCmd.Parameters.Add("@.Telephone", TxtTelephone.Replace(" ", ""))
That worked just fine in a Response.Write("".Replace(" ", "")), so unless there is something else that will cause an error, that should work. Looking further, it appears you have a Period (.)between
your parameters (which is what it actually picked up since and it hasn't processed the String.Text property issue yet) instead of a Comma (,).

EDIT: Not sure what I was thinking for part of this. I was assuming TxtTelephone was a String variable rather than a Control of some sort. Yeah, you would do DBCmd.Parameters.Add("@.Telephone", TxtTelephone.Replace(" ", "")) and just the comma is missing, having a period instead..
If I'm not mistaken, in this section:
TxtTelephone.Text.Replace(" ". ""))
that's a period between the two sections - - make it a comma
note: technically, it should work this way - I just normally do any replacement of anything completely before any areas like this, to get it out of the way before any database processing - - but, that's just my preference
Thanks
Its amazing all that time and it was a period instead of a commer.
With regards to manipulating the string before any database stuff is done that is what i was originally trying to do. Oh well ill get rounnd to it.
I have just realised that i will need to check to see if the email address exists and if so send them to a page that says email exists if you have forgotten your password please click here
Its going to be a long road.
Thanks guys i really needed your help
Good one!!

text writing security worries

Hi,

I'm writing an application to load, edit and save xml with a flash7 front-end using .net scripts to write the xml.

Here's the script I'm using to save the xml:

private void Page_Load(object sender, System.EventArgs e){

String fileUrl;
String xmlData;
String returnToFlash;

fileUrl = Request.Form["fileUrl"];
xmlData = Request.Form["xmlData"];

StreamWriter sr = File.CreateText(Server.MapPath(fileUrl));
sr.WriteLine(xmlData);
sr.Close();

returnToFlash = "data=Success";
Response.Write(returnToFlash);

}

It's pretty simple, which is why I'm worried about the possibility of people 'spoofing' it with false data that hasn't come from my flash app.

There is a login script too which will (eventually) check the user credentials against a database to allow access. I was thinking that perhaps I should send these login credentials when saving a file to authenticate the user. Although I'm pretty sure there must be a better way to do it - ideally I don't want users to poll the database more than once per session.

This must be a problem that flash developers face all the time, I just haven't been able to find any articles on the topic (as I don't fully understand what I'm looking for!)

So my question is: What is the best way to secure access to this script without sending a username and password to check a database?

ThanksIt's a scary proposition when you are going to allow files to be uploaded to a web server. You should develop a strategy that allows you to upload files to a directory that only has Write permissions for the ASPNET/Network Service account as you want to prevent anyone from uploading an executable and being able to execute it.

That said, there is alot to security and this situation. I recommend you check out "Improving Web Application Security" and "Building Secure ASP.NET Applications".
I didn't consider the ASPNET/Network Service account permissions. They have already been set for me by hosting company for the directory I'm writing to. Perhaps this is enough?
Thanks for the links, I'll give them a read.