Finish hotfix/OS-77_main

OS-77 hotfix

Author: dragos-dobre

IMIS_DAL/FamilyDAL.vb

@@ -394,8 +394,9 @@ Public Class FamilyDAL
         Dim data As New ExactSQL
         Dim sSQL As String = ""
         Dim dt As New DataTable
-        sSQL = "Select * FROM tblInsuree WHERE CHFID = '" & CHFID & "' AND ValidityTo IS NULL"
+        sSQL = "Select * FROM tblInsuree WHERE CHFID = @chfid AND ValidityTo IS NULL"
         data.setSQLCommand(sSQL, CommandType.Text)
+        data.params("@chfid", SqlDbType.NVarChar, 12, CHFID)
         Return data.Filldata
     End Function
     Public Function CheckCanBeDeleted(ByVal FamilyID As Integer) As DataTable

IMIS_DAL/RoleDAL.vb

@@ -39,7 +39,7 @@ Public Class RoleDAL
         sSQL += "SET @IsDefaultLanguage = 0"
         sSQL += "SELECT [RoleID],[RoleUUID],CASE WHEN @IsDefaultLanguage = 1 THEN [RoleName] ELSE ISNULL(NULLIF(AltLanguage, ''),RoleName) END RoleName, CASE WHEN [IsSystem] > 0 THEN 'True' Else 'False' END System,isSystem,ISNULL(AltLanguage,RoleName) AltLanguage,"
         sSQL += " CASE WHEN [IsBlocked] = 1 THEN 'True' ELSE 'False' END Blocked,[ValidityFrom],[ValidityTo],[AuditUserID],[LegacyID] FROM tblRole"
-        sSQL += " WHERE (Rolename like '" & erole.RoleName & "%' OR AltLanguage LIKE '" & erole.AltLanguage & "%') AND (isBlocked = @isBlocked OR @isBlocked IS NULL)"
+        sSQL += " WHERE (Rolename like @RoleName OR AltLanguage LIKE @AltLanguage) AND (isBlocked = @isBlocked OR @isBlocked IS NULL)"
         If erole.IsSystem IsNot Nothing Then
             If erole.IsSystem = 1 Then
                 sSQL += " AND isSystem > 0"
@@ -54,7 +54,8 @@ Public Class RoleDAL
         End If
 
         data.setSQLCommand(sSQL, CommandType.Text)
-        'data.params("@RoleName", SqlDbType.NVarChar, 50, erole.RoleName)
+        data.params("@RoleName", SqlDbType.NVarChar, 50, $"%{erole.RoleName}%")
+        data.params("@AltLanguage", SqlDbType.NVarChar, 50, $"%{erole.AltLanguage}%")
         data.params("@IsSystem", SqlDbType.Bit, erole.IsSystem)
         data.params("@IsBlocked", SqlDbType.Bit, erole.IsBlocked)
         data.params("@UserId", SqlDbType.Int, userId)

IMIS_DAL/UsersDAL.vb

@@ -206,14 +206,13 @@ AND (isSystem <> 0 AND isSystem NOT IN (1,2,4,256, 128,16,32,64,512,524288))) )"
     Public Function IsUserExists(ByVal UserID As Integer) As Boolean
         Dim sSQL As String = String.Empty
         Dim data As New ExactSQL
-        Dim strSQL As String = "Select Top 1 * from tblUsers where  tblUsers.UserId = @UserId AND tblUsers.UserId = @UserId AND isAssociated = 1 AND ValidityTo is null" 'LoginName = @LoginName and 
+        Dim strSQL As String = "Select Top 1 * from tblUsers where  tblUsers.UserId = @UserId AND tblUsers.UserId = @UserId AND isAssociated = 1 AND ValidityTo is null"
 
         If Not UserID = 0 Then
             strSQL += " AND tblUsers.UserId = @UserId"
         End If
 
         data.setSQLCommand(strSQL, CommandType.Text)
-        'data.params("@LoginName", SqlDbType.NVarChar, 25, eUserID)
         If Not UserID = 0 Then
             data.params("@UserId", SqlDbType.Int, UserID)
         End If