Date Format Problem - SQL Server Insert From Web Application

Discussion in 'ASP .Net Web Services' started by Steve, May 1, 2005.

  1. Steve

    Steve Guest

    Hi,

    I've written a short aspx file so that end users can insert lines into our
    SQL server database. The following string is sent by Internet Explorer to
    the database where it updates the relevant table -

    INSERT INTO Tbl_Manual([Data Date],[Staff ID], Flag1, Flag2, Flag3, Ref1,
    Ref2, Timestamp, Inputter) values('15/05/2005', '89', '1', '0', '0', '77',
    '8', '01/05/2005 08:54:10', 'HOME\username')

    The 2nd date is sent as a string into an nvarchar field so it causes no
    problems but the first (which is heading for a datetime field) is assumed by
    SQL to be MM/dd/yyyy format no matter what I try to do. All regional
    settings are set to UK English & the table in SQL correctly uses dd/MM/yyyy
    format so the above insert command fails thinking that I'm trying to add a
    date of the 5th of month 15.

    If I try input a date as mm/dd/yyyy format into the aspx page, an error is
    thrown back.

    Any ideas as to what's going wrong ?

    Thanks

    Steve
    Steve, May 1, 2005
    #1
    1. Advertising

  2. Steve

    greybeard Guest

    You can set date in an universal format 'yyyymmdd',
    or use convert(datetime,'dd/mm/yyyy',103) function, see MS SQL Help or
    http://www.karaszi.com/SQLServer/info_datetime.asp

    Vlastik

    "Steve" <0m> pí¹e v diskusním pøíspìvku
    news:...
    > Hi,
    >
    > I've written a short aspx file so that end users can insert lines into our
    > SQL server database. The following string is sent by Internet Explorer to
    > the database where it updates the relevant table -
    >
    > INSERT INTO Tbl_Manual([Data Date],[Staff ID], Flag1, Flag2, Flag3, Ref1,
    > Ref2, Timestamp, Inputter) values('15/05/2005', '89', '1', '0', '0', '77',
    > '8', '01/05/2005 08:54:10', 'HOME\username')
    >
    > The 2nd date is sent as a string into an nvarchar field so it causes no
    > problems but the first (which is heading for a datetime field) is assumed

    by
    > SQL to be MM/dd/yyyy format no matter what I try to do. All regional
    > settings are set to UK English & the table in SQL correctly uses

    dd/MM/yyyy
    > format so the above insert command fails thinking that I'm trying to add a
    > date of the 5th of month 15.
    >
    > If I try input a date as mm/dd/yyyy format into the aspx page, an error is
    > thrown back.
    >
    > Any ideas as to what's going wrong ?
    >
    > Thanks
    >
    > Steve
    >
    >
    greybeard, May 1, 2005
    #2
    1. Advertising

  3. Steve

    Uri Dimant Guest

    Steve
    Always use 'YYYYMMDD' to insert data into SQL Server table. To display dates
    use FORMAT or other functions to format to be suitable to the client.


    "Steve" <0m> wrote in message
    news:...
    > Hi,
    >
    > I've written a short aspx file so that end users can insert lines into our
    > SQL server database. The following string is sent by Internet Explorer to
    > the database where it updates the relevant table -
    >
    > INSERT INTO Tbl_Manual([Data Date],[Staff ID], Flag1, Flag2, Flag3, Ref1,
    > Ref2, Timestamp, Inputter) values('15/05/2005', '89', '1', '0', '0', '77',
    > '8', '01/05/2005 08:54:10', 'HOME\username')
    >
    > The 2nd date is sent as a string into an nvarchar field so it causes no
    > problems but the first (which is heading for a datetime field) is assumed

    by
    > SQL to be MM/dd/yyyy format no matter what I try to do. All regional
    > settings are set to UK English & the table in SQL correctly uses

    dd/MM/yyyy
    > format so the above insert command fails thinking that I'm trying to add a
    > date of the 5th of month 15.
    >
    > If I try input a date as mm/dd/yyyy format into the aspx page, an error is
    > thrown back.
    >
    > Any ideas as to what's going wrong ?
    >
    > Thanks
    >
    > Steve
    >
    >
    Uri Dimant, May 1, 2005
    #3
  4. Date formats are set on the connection level in SQL Server, not database or
    server wide. If they are not explicitly set, they are derived from the
    default settings for the login that uses the connection. It appears to me
    that the login you use to connect to the database has it's language (which
    also includes the date format)set to British, but the login that you web app
    uses to connect to the database, has it language set to English, i.e. U.S.
    English.

    --
    Jacco Schalkwijk
    SQL Server MVP


    "Steve" <0m> wrote in message
    news:...
    > Hi,
    >
    > I've written a short aspx file so that end users can insert lines into our
    > SQL server database. The following string is sent by Internet Explorer to
    > the database where it updates the relevant table -
    >
    > INSERT INTO Tbl_Manual([Data Date],[Staff ID], Flag1, Flag2, Flag3, Ref1,
    > Ref2, Timestamp, Inputter) values('15/05/2005', '89', '1', '0', '0', '77',
    > '8', '01/05/2005 08:54:10', 'HOME\username')
    >
    > The 2nd date is sent as a string into an nvarchar field so it causes no
    > problems but the first (which is heading for a datetime field) is assumed
    > by SQL to be MM/dd/yyyy format no matter what I try to do. All regional
    > settings are set to UK English & the table in SQL correctly uses
    > dd/MM/yyyy format so the above insert command fails thinking that I'm
    > trying to add a date of the 5th of month 15.
    >
    > If I try input a date as mm/dd/yyyy format into the aspx page, an error is
    > thrown back.
    >
    > Any ideas as to what's going wrong ?
    >
    > Thanks
    >
    > Steve
    >
    >
    Jacco Schalkwijk, May 1, 2005
    #4
  5. Steve

    Steve Guest

    Thanks Jacco - You got it in one. You have no idea how long I've been trying
    to fix this!!!

    I'd set a local account up on the server for testing things - trust
    Microsoft to default things to 'english' which being from England myself I
    would have assumed to be correct rather than having to choose 'British
    English' !

    Steve


    "Jacco Schalkwijk" <> wrote
    in message news:...
    > Date formats are set on the connection level in SQL Server, not database
    > or server wide. If they are not explicitly set, they are derived from the
    > default settings for the login that uses the connection. It appears to me
    > that the login you use to connect to the database has it's language (which
    > also includes the date format)set to British, but the login that you web
    > app uses to connect to the database, has it language set to English, i.e.
    > U.S. English.
    >
    > --
    > Jacco Schalkwijk
    > SQL Server MVP
    >
    >
    > "Steve" <0m> wrote in message
    > news:...
    >> Hi,
    >>
    >> I've written a short aspx file so that end users can insert lines into
    >> our SQL server database. The following string is sent by Internet
    >> Explorer to the database where it updates the relevant table -
    >>
    >> INSERT INTO Tbl_Manual([Data Date],[Staff ID], Flag1, Flag2, Flag3, Ref1,
    >> Ref2, Timestamp, Inputter) values('15/05/2005', '89', '1', '0', '0',
    >> '77', '8', '01/05/2005 08:54:10', 'HOME\username')
    >>
    >> The 2nd date is sent as a string into an nvarchar field so it causes no
    >> problems but the first (which is heading for a datetime field) is assumed
    >> by SQL to be MM/dd/yyyy format no matter what I try to do. All regional
    >> settings are set to UK English & the table in SQL correctly uses
    >> dd/MM/yyyy format so the above insert command fails thinking that I'm
    >> trying to add a date of the 5th of month 15.
    >>
    >> If I try input a date as mm/dd/yyyy format into the aspx page, an error
    >> is thrown back.
    >>
    >> Any ideas as to what's going wrong ?
    >>
    >> Thanks
    >>
    >> Steve
    >>
    >>

    >
    >
    Steve, May 1, 2005
    #5
  6. Steve

    Mercury Guest

    I suggest that you read up about SQL Code Injection once you have this
    resolved. The implication from your question is that data is more or less
    coming off a web form straight into the database and as such may be highly
    vulnerable to hacking.


    "Steve" <0m> wrote in message
    news:...
    > Hi,
    >
    > I've written a short aspx file so that end users can insert lines into our
    > SQL server database. The following string is sent by Internet Explorer to
    > the database where it updates the relevant table -
    >
    > INSERT INTO Tbl_Manual([Data Date],[Staff ID], Flag1, Flag2, Flag3, Ref1,
    > Ref2, Timestamp, Inputter) values('15/05/2005', '89', '1', '0', '0', '77',
    > '8', '01/05/2005 08:54:10', 'HOME\username')
    >
    > The 2nd date is sent as a string into an nvarchar field so it causes no
    > problems but the first (which is heading for a datetime field) is assumed
    > by SQL to be MM/dd/yyyy format no matter what I try to do. All regional
    > settings are set to UK English & the table in SQL correctly uses
    > dd/MM/yyyy format so the above insert command fails thinking that I'm
    > trying to add a date of the 5th of month 15.
    >
    > If I try input a date as mm/dd/yyyy format into the aspx page, an error is
    > thrown back.
    >
    > Any ideas as to what's going wrong ?
    >
    > Thanks
    >
    > Steve
    >
    >
    Mercury, May 1, 2005
    #6
  7. Steve

    Cor Ligthert Guest

    >
    > I'd set a local account up on the server for testing things - trust
    > Microsoft to default things to 'english' which being from England myself I
    > would have assumed to be correct rather than having to choose 'British
    > English' !
    >

    LOL
    Cor Ligthert, May 1, 2005
    #7
  8. Steve

    Dan Guzman Guest

    The original poster might consider a parameterized query. This will address
    both the SQL injection security issue as well as date string formatting.

    --
    Hope this helps.

    Dan Guzman
    SQL Server MVP

    "Mercury" <> wrote in message
    news:d52dsi$ac7$...
    >I suggest that you read up about SQL Code Injection once you have this
    >resolved. The implication from your question is that data is more or less
    >coming off a web form straight into the database and as such may be highly
    >vulnerable to hacking.
    >
    >
    > "Steve" <0m> wrote in message
    > news:...
    >> Hi,
    >>
    >> I've written a short aspx file so that end users can insert lines into
    >> our SQL server database. The following string is sent by Internet
    >> Explorer to the database where it updates the relevant table -
    >>
    >> INSERT INTO Tbl_Manual([Data Date],[Staff ID], Flag1, Flag2, Flag3, Ref1,
    >> Ref2, Timestamp, Inputter) values('15/05/2005', '89', '1', '0', '0',
    >> '77', '8', '01/05/2005 08:54:10', 'HOME\username')
    >>
    >> The 2nd date is sent as a string into an nvarchar field so it causes no
    >> problems but the first (which is heading for a datetime field) is assumed
    >> by SQL to be MM/dd/yyyy format no matter what I try to do. All regional
    >> settings are set to UK English & the table in SQL correctly uses
    >> dd/MM/yyyy format so the above insert command fails thinking that I'm
    >> trying to add a date of the 5th of month 15.
    >>
    >> If I try input a date as mm/dd/yyyy format into the aspx page, an error
    >> is thrown back.
    >>
    >> Any ideas as to what's going wrong ?
    >>
    >> Thanks
    >>
    >> Steve
    >>
    >>

    >
    >
    Dan Guzman, May 1, 2005
    #8
  9. Steve

    Steve Guest

    > The original poster might consider a parameterized query. This will
    > address both the SQL injection security issue as well as date string
    > formatting.


    I may go on to look at that but I'm currently not too bothered about hacking
    attempts as the form is for intranet use only - I just need something quick
    & dirty !

    Thanks

    Steve
    Steve, May 1, 2005
    #9
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Brian Candy
    Replies:
    2
    Views:
    1,140
    Janaka
    Feb 18, 2004
  2. Peter Grison

    Date, date date date....

    Peter Grison, May 28, 2004, in forum: Java
    Replies:
    10
    Views:
    3,205
    Michael Borgwardt
    May 30, 2004
  3. mukesh bhakta
    Replies:
    3
    Views:
    7,408
    wm.wragg
    Sep 5, 2006
  4. dave
    Replies:
    2
    Views:
    1,915
    daveh551
    Dec 4, 2008
  5. Robin Lawrie
    Replies:
    18
    Views:
    772
    Mark Schupp
    Mar 1, 2005
Loading...

Share This Page