Updating entry in Database in Asp.net

Question

I am trying to update an entry in a database on an aspx page. I have an aspx page which shows an items with three properties. When I click edit an item to update one or all of the properties and click on update, I get the following errors are:

System.Data.SqlClient.SqlException: 'Incorrect syntax near '('.'

My aspx code is as follows:

<div class="row">
    <div class="col-md-6 col-md-offset-3">
        <div class="col-lg-12">
            <div class="form-group alert alert-warning">
               <asp:label runat="server" ID="lblNewsEdits">Please edit news details below</asp:label>
            </div>
            <div class="form-group">
                <asp:TextBox name="txtTitle" id="txtTitle" tabindex="1" class="form-control" placeholder="Title" value="" runat="server"></asp:TextBox>
            </div>
            <div class="form-group">
                <asp:TextBox name="txtDate" id="txtDate" tabindex="1" class="form-control" placeholder="Enter Today Date DD/MM/YYYY" value="" runat="server"></asp:TextBox>
            </div>
            <div class="form-group">
                <asp:TextBox namee="txtNewscontent" name="txtNewscontent" id="txtNewscontent" tabindex="2" class="form-control" placeholder="News Content" runat="server"></asp:TextBox>
            </div>
            <div class="form-group">
                <div class="row">
                    <div class="col-sm-6 col-sm-offset-3">
                        <input type="submit" name="btnEdit" id="btnEdit" tabindex="1" class="form-control btn btn-warning" value="Edit"/>
                    </div>
                </div>
                <div class="row">
                    <div class="col-md-1 col-md-offset-11">
                        <a href="/Backend/Default.aspx" class="btn btn-default pull-right">Back</a>
                    </div>
                </div>    
            </div>
        </div>
    </div>
</div>

My aspx.cs code is:

 protected void Page_Load(object sender, EventArgs e)
    {
        {
            string q = Request.QueryString["id"];
            int id = 0;
            int.TryParse(q, out id);

            if (Session["username"] == null)
                Response.Redirect("Login.aspx");

            if (IsPostBack)
            {
                EditNews(id);
                Response.Redirect("~/Backend");
            }
            else
            {
                PopulateNews(id);
            }
        }
    }
    private void EditNews(int id)
    {
        //Create a SQL Connection - get the connection string from the web.config
        SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings["AppConnectionString"].ConnectionString);
        //define the SQL statement you wish to run - use @ placeholders to populate parameters
        string sqlStatement = "UPDATE News (Title, DatePosted, NewsContent) Values (@Title,@DatePosted,@NewsContent);";
        //Set up the SQL Command
        SqlCommand command = new SqlCommand(sqlStatement, connection);
        //Populate the placeholders with parameter values
        command.Parameters.AddWithValue("@Title", txtTitle.Text);
        command.Parameters.AddWithValue("@DatePosted", Convert.ToDateTime(txtDate.Text));
        command.Parameters.AddWithValue("@NewsContent", txtNewscontent.Text);
        //open a connection to the database (NOTE! dont forget to close this when you are done)
        connection.Open();
        //Run the SQL statement against the database
        command.ExecuteNonQuery();
        command.Dispose();
        //NOTE! close the connection
        connection.Close();
    }
    private void PopulateNews(int id)
    {
        SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings["AppConnectionString"].ConnectionString);
        connection.Open();
        string query = "SELECT Title, DatePosted, NewsContent FROM News WHERE Id = @id";

        SqlCommand command = new SqlCommand(query, connection);
        command.Parameters.AddWithValue("@id", id);
        SqlDataReader reader = command.ExecuteReader();

        while (reader.Read())
        {
            txtTitle.Text = reader["Title"].ToString();
            txtDate.Text = reader["DatePosted"].ToString();
            txtNewscontent.Text = reader["NewsContent"].ToString();
        }
        reader.Close();
        connection.Close();
    }

My table properties are:

CREATE TABLE [dbo].[News] (
[Id]          INT            IDENTITY (1, 1) NOT NULL,
[Title]       NVARCHAR (100) NOT NULL,
[DatePosted]  DATE           NOT NULL,
[NewsContent] NTEXT          NOT NULL,
[IsRead]      BIT            DEFAULT ((0)) NULL,
PRIMARY KEY CLUSTERED ([Id] ASC)
);

Any ideas?

Answer 1

The syntax of your update statement is incorrect.

UPDATE News (Title, DatePosted, NewsContent) Values (@Title,@DatePosted,@NewsContent);

Should be

UPDATE News 
SET Title = @Title, DatePosted = @DatePosted, NewsContent = @NewsContent
WHERE -- some discriminator here like match on ID

---

If you meant to do an instert (adding) then the syntax should be

INSERT INTO News (Title, DatePosted, NewsContent) Values (@Title,@DatePosted,@NewsContent);

---

One additional recommendations. If a type implements interface IDisposable then it is best practice to wrap that instance in a using block to ensure external resources are always released. SqlConnection and SqlCommand and SqlDataReader all implement IDisposable. Example:

using(SqlConnection connection = new SqlConnection(ConfigurationManager.ConnectionStrings["AppConnectionString"].ConnectionString) 
{
    // rest of code here
}

Now the connection is always closed and disposed, even if an Exception is thrown, once the block is exited.

Answer 2

Your Update statement is wrong.

Replace it with Insert into. It will work

So, instead of

string sqlStatement = "UPDATE News (Title, DatePosted, NewsContent) Values (@Title,@DatePosted,@NewsContent);";

You need

string sqlStatement = "Insert into News (Title, DatePosted, NewsContent) Values (@Title,@DatePosted,@NewsContent);";

If you really need update query them its syntax is different

Update TableName Set Field1=@value1, … Where ConditionHere