Question: I'm new to C#. I searched the web with no success
on finding an answer to my question, maybe it's only a term/syntax
which I'm missing out.

I'm learning some program which somebody else wrote. The program includes 
some classes in different files which are included with the project.

at the main program file instead of the way I know for declaring a new
instance of these classes this method is used:

```
 namespace Technology_A3000_A4_A42107
{
    public partial class FormTechnology : Form
    {
        ...
        private AST_NET _device;
        private ClassTechnology _technology;
        private ClassGain _gain;
        ....
    }

           public FormTechnology()
        {
            ...
            _device = new AST_NET();
            _technology = new ClassTechnology(_device);
            _gain = new ClassGain();
            ....
        }

    ....    

```

What exactly is done here? is this equivalent to writing
the row below, or is it needed due to some external file 
or some other property of the classes?

```
private AST_NET _device = new AST_NET(); 

```

Thanks in advance and sorry if this 
is not an appropriate question.
Amitai

Answer: 
This seems more like a design issue, assuming the user is filling in a form you can retrieve the row values from the database and have the form pre-filled, then when they submit the values you'd just be overwriting the existing data rather than having a long winded SQL statement check if values are empty.

**Secondly**, *always* validate and sanitize you user input, never trust it. Not only will this prevent errors (Undefined index[...]) but it will also prevent those with malicious intent to attack your site.

**Thirdly**, seeing as you are using `mysqli_*`, why don't you just make use of prepared statements to prevent [SQL Injection](http://bobby-tables.com/img/xkcd.png).

**Note:** Your [constructor](http://php.net/manual/en/mysqli.construct.php) for `mysqli_*` is in the OOP form but you are using procedural functions further on. For the sake of consistency, please choose procedural or OO. 

**Reading Material**

[How can I prevent SQL injection in PHP?](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1)
You can check it via `empty()` in PHP as you said or try to take advantage of SQL and use:

```
UPDATE mytable t
   SET t.col = IF(foo='',t.col,foo) 
WHERE ...

```

EDIT: Also I would suggest to use [PDO prepared statements](https://www.w3schools.com/PhP/php_mysql_prepared_statements.asp). Because now you are vulnerable to [SQLi injection](https://www.w3schools.com/sql/sql_injection.asp).