CODEWITHSUNDEEP
asp.net
Tarang
Tarang

Reputation: 1

System.Data.SqlClient.SqlException: Incorrect syntax near ''

cmd.Connection = con;
con.Open();
cmd.CommandText = "Update tiit.Enquiry Set Status='" + DropDownList4.SelectedValue + "', NextFollowup='" + TextBox8.Text + "', Remarks='" + TextBox9.Text + "', Name='" + TextBox1.Text + "', Email='" + TextBox2.Text + "', Phone='" + TextBox3.Text + "','','','','', City='" + TextBox4.Text + "', Country='" + TextBox5.Text + "', Course='" + TextBox6.Text + "', Comments='" + TextBox7.Text + "', Cost='" +TextBox14.Text+ "' where SN='" + HiddenField1.Value + "'";
int i = cmd.ExecuteNonQuery();
con.Close();

Upvotes: 0

Views: 4989

Answers (2)

m.edmondson
m.edmondson

Reputation: 30872

In all probability this:

"Update tiit.Enquiry Set Status='"

is you problem. (I'm talking about the .)

I completely agree however - use parametrised queries.

Upvotes: 3

Darin Dimitrov
Darin Dimitrov

Reputation: 1038720

No, don't do this. Never use string concatenations (+ operator) when building your SQL queries. Use parametrized queries:

cmd.Connection = con; 
con.Open(); 
cmd.CommandText = "UPDATE tiit.Enquiry Set Status=@Status, NextFollowup=@NextFollowup, ...";
cmd.Parameters.AddWithValue("@Status", DropDownList4.SelectedValue);
cmd.Parameters.AddWithValue("@NextFollowup", TextBox8.Text);
...

This way your code won't be vulnerable to SQL injection and you won't have any encoding problems.

Upvotes: 3

Related Questions