mcs/class/Mainsoft.Web/Mainsoft.Web.Security/DerbyRolesHelper.cs

   1 //\r
   2 // Mainsoft.Web.Security.DerbyRolesHelper\r
   3 //\r
   4 // Authors:\r
   5 //      Vladimir Krasnov (vladimirk@mainsoft.com)\r
   6 //\r
   7 // (C) 2006 Mainsoft\r
   8 //\r
   9 //\r
  10 // Permission is hereby granted, free of charge, to any person obtaining\r
  11 // a copy of this software and associated documentation files (the\r
  12 // "Software"), to deal in the Software without restriction, including\r
  13 // without limitation the rights to use, copy, modify, merge, publish,\r
  14 // distribute, sublicense, and/or sell copies of the Software, and to\r
  15 // permit persons to whom the Software is furnished to do so, subject to\r
  16 // the following conditions:\r
  17 // \r
  18 // The above copyright notice and this permission notice shall be\r
  19 // included in all copies or substantial portions of the Software.\r
  20 // \r
  21 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,\r
  22 // EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\r
  23 // MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND\r
  24 // NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE\r
  25 // LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\r
  26 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION\r
  27 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\r
  28 //\r
  29 \r
  30 \r
  31 using System;\r
  32 using System.Web.Security;\r
  33 using System.Data;\r
  34 using System.Data.OleDb;\r
  35 using System.Data.Common;\r
  36 using System.Collections.Generic;\r
  37 using System.Text;\r
  38 \r
  39 namespace Mainsoft.Web.Security\r
  40 {\r
  41         static class DerbyRolesHelper\r
  42         {\r
  43                 private static OleDbParameter AddParameter (OleDbCommand command, string paramName, object paramValue)\r
  44                 {\r
  45                         OleDbParameter prm = new OleDbParameter (paramName, paramValue);\r
  46                         command.Parameters.Add (prm);\r
  47                         return prm;\r
  48                 }\r
  49 \r
  50                 public static int Roles_CreateRole (DbConnection connection, string applicationName, string rolename)\r
  51                 {\r
  52                         string appId = (string) DerbyApplicationsHelper.Applications_CreateApplication (connection, applicationName);\r
  53                         if (appId == null)\r
  54                                 return 1;\r
  55 \r
  56                         string querySelect = "SELECT RoleName FROM aspnet_Roles WHERE ApplicationId = ? AND LoweredRoleName = ?";\r
  57                         OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
  58                         AddParameter (cmdSelect, "ApplicationId", appId);\r
  59                         AddParameter (cmdSelect, "LoweredRoleName", rolename.ToLowerInvariant ());\r
  60 \r
  61                         using (OleDbDataReader reader = cmdSelect.ExecuteReader ()) {\r
  62                                 if (reader.Read ())\r
  63                                         return 2; // role already exists\r
  64                         }\r
  65 \r
  66                         string queryInsert = "INSERT INTO aspnet_Roles (ApplicationId, RoleId, RoleName, LoweredRoleName) VALUES (?, ?, ?, ?)";\r
  67                         OleDbCommand cmdInsert = new OleDbCommand (queryInsert, (OleDbConnection) connection);\r
  68                         AddParameter (cmdInsert, "ApplicationId", appId);\r
  69                         AddParameter (cmdInsert, "RoleId", Guid.NewGuid ().ToString ());\r
  70                         AddParameter (cmdInsert, "RoleName", rolename);\r
  71                         AddParameter (cmdInsert, "LoweredRoleName", rolename.ToLowerInvariant ());\r
  72                         cmdInsert.ExecuteNonQuery ();\r
  73 \r
  74                         return 0;\r
  75                 }\r
  76 \r
  77                 public static int Roles_DeleteRole (DbConnection connection, string applicationName, string rolename, bool deleteOnlyIfRoleIsEmpty)\r
  78                 {\r
  79                         string appId = DerbyApplicationsHelper.GetApplicationId (connection, applicationName);\r
  80                         if (appId == null)\r
  81                                 return 1;\r
  82 \r
  83                         string roleId = GetRoleId (connection, appId, rolename);\r
  84                         if (roleId == null)\r
  85                                 return 2;\r
  86 \r
  87                         if (deleteOnlyIfRoleIsEmpty) {\r
  88                                 string querySelect = "SELECT RoleId FROM aspnet_UsersInRoles WHERE RoleId = ?";\r
  89                                 OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
  90                                 AddParameter (cmdSelect, "RoleId", roleId);\r
  91                                 using (OleDbDataReader reader = cmdSelect.ExecuteReader ()) {\r
  92                                         if (reader.Read ())\r
  93                                                 // role is not empty\r
  94                                                 return 3;\r
  95                                 }\r
  96                         }\r
  97 \r
  98                         string queryDelUsers = "DELETE FROM aspnet_UsersInRoles WHERE RoleId = ?";\r
  99                         OleDbCommand cmdDelUsers = new OleDbCommand (queryDelUsers, (OleDbConnection) connection);\r
 100                         AddParameter (cmdDelUsers, "RoleId", roleId);\r
 101                         cmdDelUsers.ExecuteNonQuery ();\r
 102 \r
 103                         string queryDelRole = "DELETE FROM aspnet_Roles WHERE ApplicationId = ? AND RoleId = ? ";\r
 104                         OleDbCommand cmdDelRole = new OleDbCommand (queryDelRole, (OleDbConnection) connection);\r
 105                         AddParameter (cmdDelRole, "ApplicationId", appId);\r
 106                         AddParameter (cmdDelRole, "RoleId", roleId);\r
 107                         cmdDelRole.ExecuteNonQuery ();\r
 108 \r
 109                         return 0;\r
 110                 }\r
 111 \r
 112                 public static int Roles_GetAllRoles (DbConnection connection, string applicationName, out DbDataReader reader)\r
 113                 {\r
 114                         reader = null;\r
 115                         string appId = DerbyApplicationsHelper.GetApplicationId (connection, applicationName);\r
 116                         if (appId == null)\r
 117                                 return 1;\r
 118 \r
 119                         string querySelect = "SELECT RoleName FROM aspnet_Roles WHERE ApplicationId = ? ORDER BY RoleName";\r
 120                         OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
 121                         AddParameter (cmdSelect, "ApplicationId", appId);\r
 122                         reader = cmdSelect.ExecuteReader ();\r
 123 \r
 124                         return 0;\r
 125                 }\r
 126 \r
 127                 public static int Roles_RoleExists (DbConnection connection, string applicationName, string rolename)\r
 128                 {\r
 129                         string appId = DerbyApplicationsHelper.GetApplicationId (connection, applicationName);\r
 130                         if (appId == null)\r
 131                                 return 1;\r
 132 \r
 133                         string querySelect = "SELECT RoleName FROM aspnet_Roles WHERE ApplicationId = ? AND LoweredRoleName = ?";\r
 134                         OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
 135                         AddParameter (cmdSelect, "ApplicationId", appId);\r
 136                         AddParameter (cmdSelect, "LoweredRoleName", rolename.ToLowerInvariant ());\r
 137 \r
 138                         using (OleDbDataReader reader = cmdSelect.ExecuteReader ()) {\r
 139                                 if (reader.Read ())\r
 140                                         return 2;\r
 141                         }\r
 142                         return 0;\r
 143                 }\r
 144 \r
 145                 public static int UsersInRoles_AddUsersToRoles (DbConnection connection, string applicationName, string [] userNames, string [] roleNames, DateTime currentTimeUtc)\r
 146                 {\r
 147                         string appId = DerbyApplicationsHelper.GetApplicationId (connection, applicationName);\r
 148                         if (appId == null)\r
 149                                 return 1;\r
 150 \r
 151                         string [] userIds = new string [userNames.Length];\r
 152                         string [] loweredUsernames = new string [userNames.Length];\r
 153                         string [] roleIds = new string [roleNames.Length];\r
 154 \r
 155                         string querySelUsers = "SELECT UserId, LoweredUserName FROM aspnet_Users WHERE ApplicationId = ? AND LoweredUserName in " + GetPrms (userNames.Length);\r
 156                         OleDbCommand cmdSelUsers = new OleDbCommand (querySelUsers, (OleDbConnection) connection);\r
 157                         AddParameter (cmdSelUsers, "ApplicationId", appId);\r
 158                         for (int i = 0; i < userNames.Length; i++)\r
 159                                 AddParameter (cmdSelUsers, "LoweredUserName", userNames [i].ToLowerInvariant ());\r
 160 \r
 161                         int userIndex = 0;\r
 162                         using (OleDbDataReader reader = cmdSelUsers.ExecuteReader ()) {\r
 163                                 while (reader.Read ()) {\r
 164                                         userIds [userIndex] = reader.GetString (0);\r
 165                                         loweredUsernames [userIndex] = reader.GetString (1);\r
 166                                         userIndex++;\r
 167                                 }\r
 168                         }\r
 169 \r
 170                         if (userNames.Length != userIndex) {\r
 171                                 // find not existing users and create them\r
 172                                 for (int j = 0; j < userNames.Length; j++)\r
 173                                         if (Array.IndexOf (loweredUsernames, userNames [j].ToLowerInvariant ()) < 0) {\r
 174                                                 string newUserId = Guid.NewGuid ().ToString ();\r
 175                                                 string queryAddUser = "INSERT INTO aspnet_Users (ApplicationId, UserId, UserName, " +\r
 176                                                         "LoweredUserName, IsAnonymous, LastActivityDate) VALUES (?, ?, ?, ?, ?, ?)";\r
 177                                                 OleDbCommand cmdAddUser = new OleDbCommand (queryAddUser, (OleDbConnection) connection);\r
 178                                                 AddParameter (cmdAddUser, "ApplicationId", appId);\r
 179                                                 AddParameter (cmdAddUser, "UserId", newUserId);\r
 180                                                 AddParameter (cmdAddUser, "UserName", userNames [j]);\r
 181                                                 AddParameter (cmdAddUser, "LoweredUserName", userNames [j].ToLowerInvariant ());\r
 182                                                 AddParameter (cmdAddUser, "IsAnonymous", 0);\r
 183                                                 AddParameter (cmdAddUser, "LastActivityDate", DateTime.UtcNow);\r
 184                                                 cmdAddUser.ExecuteNonQuery ();\r
 185 \r
 186                                                 userIds [userIndex++] = newUserId;\r
 187                                         }\r
 188                         }\r
 189 \r
 190 \r
 191                         string querySelRoles = "SELECT RoleId FROM aspnet_Roles WHERE ApplicationId = ? AND LoweredRoleName in " + GetPrms (roleNames.Length);\r
 192                         OleDbCommand cmdSelRoles = new OleDbCommand (querySelRoles, (OleDbConnection) connection);\r
 193                         AddParameter (cmdSelRoles, "ApplicationId", appId);\r
 194                         for (int i = 0; i < roleNames.Length; i++)\r
 195                                 AddParameter (cmdSelRoles, "LoweredRoleName", roleNames [i].ToLowerInvariant ());\r
 196 \r
 197                         using (OleDbDataReader reader = cmdSelRoles.ExecuteReader ()) {\r
 198                                 int i = 0;\r
 199                                 while (reader.Read ())\r
 200                                         roleIds [i++] = reader.GetString (0);\r
 201 \r
 202                                 if (roleNames.Length != i)\r
 203                                         return 2; // one or more roles not found\r
 204                         }\r
 205 \r
 206                         string querySelCount = "SELECT COUNT(*) FROM aspnet_UsersInRoles WHERE UserId in " + GetPrms (userNames.Length) + " AND RoleId in " + GetPrms (roleNames.Length);\r
 207                         OleDbCommand cmdSelCount = new OleDbCommand (querySelCount, (OleDbConnection) connection);\r
 208                         foreach (string userId in userIds)\r
 209                                 AddParameter (cmdSelCount, "UserId", userId);\r
 210                         foreach (string roleId in roleIds)\r
 211                                 AddParameter (cmdSelCount, "RoleId", roleId);\r
 212                         using (OleDbDataReader reader = cmdSelCount.ExecuteReader ()) {\r
 213                                 if (reader.Read ())\r
 214                                         if (reader.GetInt32 (0) > 0)\r
 215                                                 return 3;\r
 216                         }\r
 217 \r
 218                         string valuesExp = string.Empty;\r
 219                         int pairs = userNames.Length * roleNames.Length;\r
 220                         for (int i = 0; i < pairs; i++)\r
 221                                 valuesExp += "(?, ?),";\r
 222 \r
 223                         string queryInsert = "INSERT INTO aspnet_UsersInRoles (UserId, RoleId) VALUES " + valuesExp.Trim (',');\r
 224                         OleDbCommand cmdInsert = new OleDbCommand (queryInsert, (OleDbConnection) connection);\r
 225                         foreach (string roleId in roleIds)\r
 226                                 foreach (string userId in userIds) {\r
 227                                         AddParameter (cmdInsert, "UserId", userId);\r
 228                                         AddParameter (cmdInsert, "RoleId", roleId);\r
 229                                 }\r
 230 \r
 231                         cmdInsert.ExecuteNonQuery ();\r
 232                         return 0;\r
 233                 }\r
 234 \r
 235                 public static int UsersInRoles_FindUsersInRole (DbConnection connection, string applicationName, string rolename, string userNameToMatch, out DbDataReader reader)\r
 236                 {\r
 237                         reader = null;\r
 238                         string appId = DerbyApplicationsHelper.GetApplicationId (connection, applicationName);\r
 239                         if (appId == null)\r
 240                                 return 1;\r
 241 \r
 242                         string roleId = GetRoleId (connection, appId, rolename);\r
 243                         if (roleId == null)\r
 244                                 return 2;\r
 245 \r
 246                         string querySelect = "SELECT usr.UserName FROM aspnet_Users usr, aspnet_UsersInRoles uir " +\r
 247                                 "WHERE usr.UserId = uir.UserId AND usr.ApplicationId = ? AND uir.RoleId = ? AND LoweredUserName LIKE ? " +\r
 248                                 "ORDER BY usr.UserName";\r
 249                         OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
 250                         AddParameter (cmdSelect, "ApplicationId", appId);\r
 251                         AddParameter (cmdSelect, "RoleId", roleId);\r
 252                         AddParameter (cmdSelect, "LoweredUserName", "%" + userNameToMatch.ToLowerInvariant() + "%");\r
 253                         reader = cmdSelect.ExecuteReader ();\r
 254 \r
 255                         return 0;\r
 256                 }\r
 257 \r
 258                 public static int UsersInRoles_GetRolesForUser (DbConnection connection, string applicationName, string username, out DbDataReader reader)\r
 259                 {\r
 260                         reader = null;\r
 261                         string appId = DerbyApplicationsHelper.GetApplicationId (connection, applicationName);\r
 262                         if (appId == null)\r
 263                                 return 1;\r
 264 \r
 265                         string userId = GetUserId (connection, appId, username);\r
 266                         if (userId == null)\r
 267                                 return 2;\r
 268 \r
 269                         string querySelect = "SELECT rol.RoleName FROM aspnet_Roles rol, aspnet_UsersInRoles uir " +\r
 270                                 "WHERE rol.RoleId = uir.RoleId AND rol.ApplicationId = ? AND uir.UserId = ? ORDER BY rol.RoleName";\r
 271                         OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
 272                         AddParameter (cmdSelect, "ApplicationId", appId);\r
 273                         AddParameter (cmdSelect, "UserId", userId);\r
 274                         reader = cmdSelect.ExecuteReader ();\r
 275 \r
 276                         return 0;\r
 277                 }\r
 278 \r
 279                 public static int UsersInRoles_GetUsersInRoles (DbConnection connection, string applicationName, string rolename, out DbDataReader reader)\r
 280                 {\r
 281                         reader = null;\r
 282                         string appId = DerbyApplicationsHelper.GetApplicationId (connection, applicationName);\r
 283                         if (appId == null)\r
 284                                 return 1;\r
 285 \r
 286                         string roleId = GetRoleId (connection, appId, rolename);\r
 287                         if (roleId == null)\r
 288                                 return 2;\r
 289 \r
 290                         string querySelect = "SELECT usr.UserName FROM aspnet_Users usr, aspnet_UsersInRoles uir " +\r
 291                                 "WHERE usr.UserId = uir.UserId AND usr.ApplicationId = ? AND uir.RoleId = ? ORDER BY usr.UserName";\r
 292                         OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
 293                         AddParameter (cmdSelect, "ApplicationId", appId);\r
 294                         AddParameter (cmdSelect, "RoleId", roleId);\r
 295                         reader = cmdSelect.ExecuteReader ();\r
 296 \r
 297                         return 0;\r
 298                 }\r
 299 \r
 300                 public static int UsersInRoles_IsUserInRole (DbConnection connection, string applicationName, string username, string rolename)\r
 301                 {\r
 302                         string appId = DerbyApplicationsHelper.GetApplicationId (connection, applicationName);\r
 303                         if (appId == null)\r
 304                                 return 1;\r
 305 \r
 306                         string userId = GetUserId (connection, appId, username);\r
 307                         if (userId == null)\r
 308                                 return 2;\r
 309 \r
 310                         string roleId = GetRoleId (connection, appId, rolename);\r
 311                         if (roleId == null)\r
 312                                 return 3;\r
 313 \r
 314                         string querySelect = "SELECT UserId FROM aspnet_UsersInRoles WHERE UserId = ? AND RoleId = ?";\r
 315                         OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
 316                         AddParameter (cmdSelect, "UserId", userId);\r
 317                         AddParameter (cmdSelect, "RoleId", roleId);\r
 318                         using (OleDbDataReader reader = cmdSelect.ExecuteReader ()) {\r
 319                                 if (reader.Read ())\r
 320                                         return 4;\r
 321                         }\r
 322                         return 0;\r
 323                 }\r
 324 \r
 325                 public static int UsersInRoles_RemoveUsersFromRoles (DbConnection connection, string applicationName, string [] userNames, string [] roleNames)\r
 326                 {\r
 327                         string appId = DerbyApplicationsHelper.GetApplicationId (connection, applicationName);\r
 328                         if (appId == null)\r
 329                                 return 1;\r
 330 \r
 331                         string [] userIds = new string [userNames.Length];\r
 332                         string [] roleIds = new string [roleNames.Length];\r
 333 \r
 334                         string querySelUsers = "SELECT UserId FROM aspnet_Users WHERE ApplicationId = ? AND LoweredUserName in " + GetPrms (userNames.Length);\r
 335                         OleDbCommand cmdSelUsers = new OleDbCommand (querySelUsers, (OleDbConnection) connection);\r
 336                         AddParameter (cmdSelUsers, "ApplicationId", appId);\r
 337                         for (int i = 0; i < userNames.Length; i++)\r
 338                                 AddParameter (cmdSelUsers, "LoweredUserName", userNames [i].ToLowerInvariant ());\r
 339 \r
 340                         using (OleDbDataReader reader = cmdSelUsers.ExecuteReader ()) {\r
 341                                 int i = 0;\r
 342                                 while (reader.Read ())\r
 343                                         userIds [i++] = reader.GetString (0);\r
 344 \r
 345                                 if (userNames.Length != i)\r
 346                                         return 2; // one or more users not found\r
 347                         }\r
 348 \r
 349                         string querySelRoles = "SELECT RoleId FROM aspnet_Roles WHERE ApplicationId = ? AND LoweredRoleName in " + GetPrms (roleNames.Length);\r
 350                         OleDbCommand cmdSelRoles = new OleDbCommand (querySelRoles, (OleDbConnection) connection);\r
 351                         AddParameter (cmdSelRoles, "ApplicationId", appId);\r
 352                         for (int i = 0; i < roleNames.Length; i++)\r
 353                                 AddParameter (cmdSelRoles, "LoweredRoleName", roleNames [i].ToLowerInvariant ());\r
 354 \r
 355                         using (OleDbDataReader reader = cmdSelRoles.ExecuteReader ()) {\r
 356                                 int i = 0;\r
 357                                 while (reader.Read ())\r
 358                                         roleIds [i++] = reader.GetString (0);\r
 359 \r
 360                                 if (roleNames.Length != i)\r
 361                                         return 3; // one or more roles not found\r
 362                         }\r
 363 \r
 364                         string querySelCount = "SELECT COUNT(*) FROM aspnet_UsersInRoles WHERE UserId in " + GetPrms (userNames.Length) + " AND RoleId in " + GetPrms (roleNames.Length);\r
 365                         OleDbCommand cmdSelCount = new OleDbCommand (querySelCount, (OleDbConnection) connection);\r
 366                         foreach (string userId in userIds)\r
 367                                 AddParameter (cmdSelCount, "UserId", userId);\r
 368                         foreach (string roleId in roleIds)\r
 369                                 AddParameter (cmdSelCount, "RoleId", roleId);\r
 370                         using (OleDbDataReader reader = cmdSelCount.ExecuteReader ()) {\r
 371                                 if (reader.Read ())\r
 372                                         if (userNames.Length * roleNames.Length > reader.GetInt32 (0))\r
 373                                                 return 4;\r
 374                         }\r
 375 \r
 376                         string queryDelete = "DELETE FROM aspnet_UsersInRoles WHERE UserId in " + GetPrms (userNames.Length) + " AND RoleId in " + GetPrms (roleNames.Length);\r
 377                         OleDbCommand cmdDelete = new OleDbCommand (queryDelete, (OleDbConnection) connection);\r
 378                         foreach (string userId in userIds)\r
 379                                 AddParameter (cmdDelete, "UserId", userId);\r
 380                         foreach (string roleId in roleIds)\r
 381                                 AddParameter (cmdDelete, "RoleId", roleId);\r
 382                         cmdDelete.ExecuteNonQuery ();\r
 383 \r
 384                         return 0;\r
 385                 }\r
 386 \r
 387                 private static string GetRoleId (DbConnection connection, string applicationId, string rolename)\r
 388                 {\r
 389                         string selectQuery = "SELECT RoleId FROM aspnet_Roles WHERE LoweredRoleName = ? AND ApplicationId = ?";\r
 390 \r
 391                         OleDbCommand selectCmd = new OleDbCommand (selectQuery, (OleDbConnection) connection);\r
 392                         AddParameter (selectCmd, "LoweredRoleName", rolename.ToLowerInvariant ());\r
 393                         AddParameter (selectCmd, "ApplicationId", applicationId);\r
 394                         using (OleDbDataReader reader = selectCmd.ExecuteReader ()) {\r
 395                                 if (reader.Read ())\r
 396                                         return reader.GetString (0);\r
 397                         }\r
 398 \r
 399                         return null;\r
 400                 }\r
 401 \r
 402                 private static string GetUserId (DbConnection connection, string applicationId, string username)\r
 403                 {\r
 404                         string selectQuery = "SELECT UserId FROM aspnet_Users WHERE LoweredUserName = ? AND ApplicationId = ?";\r
 405 \r
 406                         OleDbCommand selectCmd = new OleDbCommand (selectQuery, (OleDbConnection) connection);\r
 407                         AddParameter (selectCmd, "LoweredUserName", username.ToLowerInvariant ());\r
 408                         AddParameter (selectCmd, "ApplicationId", applicationId);\r
 409                         using (OleDbDataReader reader = selectCmd.ExecuteReader ()) {\r
 410                                 if (reader.Read ())\r
 411                                         return reader.GetString (0);\r
 412                         }\r
 413 \r
 414                         return null;\r
 415                 }\r
 416 \r
 417                 private static string GetPrms (int n)\r
 418                 {\r
 419                         string exp = string.Empty;\r
 420                         for (int i = 0; i < n; i++)\r
 421                                 exp += "?,";\r
 422 \r
 423                         exp = "(" + exp.Trim (',') + ")";\r
 424                         return exp;\r
 425                 }\r
 426         }\r
 427 }\r
 428 \r