CODEWITHSUNDEEP
c#asp.net
Nik
Nik

Reputation: 1

Problem in updating database table in asp.net using c#

I want to update Basic table in my database but it doesn't generate any effect in table.
I am using following statement

sql ="UPDATE Basic SET Current_city='"+ TextBox1.Text +"',Home_Town='"+ TextBox2.Text +"';
SqlCommand cmd = new SqlCommand(sql, con);
cmd.ExecuteNonQuery();

Upvotes: 0

Views: 895

Answers (3)

Pranay Rana
Pranay Rana

Reputation: 176956

create prameterize query as blelow will resolve your issue easily.......... if you go for the code you have written will cause sql injection attack so its better to got the parametrize query. its recommended 

   SqlCommand sqlCmd = new SqlCommand("UPDATE table SET param1 = @param1", sqlConn);

   /* Parameters */
   sqlCmd.Parameters.Add("@param1", SqlDbType.NVarChar);
   sqlCmd.Parameters["@param1"].Value = valuedata;

   try
    {
        sqlConn.Open();
        sqlCmd.ExecuteNonQuery();
    }
    catch (SqlException sqlEx)
    {
        sqlErrorLabel.Text = sqlEx.ToString();
        sqlErrorLabel.ForeColor = System.Drawing.Color.Red;
    }
    finally
    {
        sqlConn.Close();
    }

Upvotes: 0

Alessandro
Alessandro

Reputation: 3760

Please don't concatenate SQL queries. You can read about Sql Injection on Wikipedia.

Use parameters instead:

sql = "UPDATE [Basic] SET [Current_city]=@City, [Home_Town]=@Town";
cmd.Parameters.Add("@City", SqlDbType.VarChar, TextBox1.Text);
cmd.Parameters.Add("@Town", SqlDbType.VarChar, TextBox2.Text);

Upvotes: 2

VikciaR
VikciaR

Reputation: 3412

Looks like, that keyworld Basic is reserved, use [Basic].

Upvotes: 0

Related Questions