c# updating database problem

Question

I am trying to update a set of data onButtonClick . i have a username , date of birth , with CurrentEmailAddress, NewEmailAdrress, ConfirmNewEmailAddress

Im trying to update all of them on a single click. I am able to update the username , but i couldnt update the date of birth and email address.

Below is my c# code: do note that myDBmanager is to execute the update and it has no problem

 //SQL query
        string updateSQL = "UPDATE user_profile,user_login SET ";
        updateSQL += "user_profile.user_name = '" + txtUserName.Text + "', ";
        updateSQL += "user_profile.user_dob = '" + txtDateOfBirth.Text + "'";


            if (txtNewPassword.Text != " " && txtNewEmailAddress.Text == " ")
            {
                updateSQL += ", user_login.user_passw = '" + txtNewPassword.Text + "'";
            }
            else if (txtNewPassword.Text == " " && txtNewEmailAddress.Text != " ")
            {
                updateSQL += ", user_profile.user_email = '" + txtNewEmailAddress.Text + "'";

            }
            else if (txtNewPassword.Text != " " && txtNewEmailAddress.Text != " ")
            {
                updateSQL += ", user_login.user_passw = '" + txtNewPassword.Text + "',";
                updateSQL += "user_profile.user_email = '" + txtNewEmailAddress.Text + "'";
            }
            else { }

            updateSQL += " WHERE user_profile.user_profile_id = 1 ";
            updateSQL += " AND user_login.user_profile_id = 1 ;";
            updateSQL += Global.myDBManager.GetNewIndex();

            int update = Global.myDBManager.ExecuteSql(updateSQL);



        //Close connection
        Global.myDBManager.Disconnect();

You really really really want to use command parameters. Building sql queries via string concatenation from user input IS EVIL. — ChrisWue
– ChrisWue, Commented Jun 28, 2011 at 7:10
Can you post the full SQL that you're executing in the question, I think that may help us come up with an answer. I find your code a little strange, why are you checking the password field in each if statement? That seems odd. And the last else {} doesn't do anything. — Haukman
– Haukman, Commented Jun 28, 2011 at 7:11
Second @ChrisWue, string concat is the recipe for SQL injection hacks (granted this may be a WinForms app, but it's still a bad practice, stay clear). — Haukman
– Haukman, Commented Jun 28, 2011 at 7:12
updateSQL += " AND user_login.user_profile_id = 1 ;"; Notice the double ";" and then you add updateSQL += Global.myDBManager.GetNewIndex(); Thus, you are actually running 2 queries (?). Anyways, what does GetNewIndex() do? — Avada Kedavra
– Avada Kedavra, Commented Jun 28, 2011 at 7:14

Matt Roberts · Accepted Answer · 2011-06-28 08:02:35Z

3

Listen to the comments in this question - what you are doing, aside from not actually working for you, is very dangerous, and ripe for SQL Injection attacks. Google for "sql injection c#" and implement a solution - this article looks good:

http://www.codeproject.com/KB/database/SqlInjectionAttacks.aspx

Once you've fixed that, you probably had/have some sort of simple code bug that is preventing your code from working, because your method (aside from the vulnerabilities) doesn't look too bad.

Stick a breakpoint on the top of the method, and work through the method, making sure the sql string is being built up as expected.

Hope that helps!

answered Jun 28, 2011 at 8:02

Matt Roberts

26.9k31 gold badges111 silver badges182 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Ashwani K · Accepted Answer · 2011-06-28 07:14:41Z

0

For checking empty string, use

!string.IsNullOrWhiteSpace(txtNewPassword.Text)

instead of

txtNewPassword.Text != " "

Thanks Ashwani

answered Jun 28, 2011 at 7:14

Ashwani K

7,99021 gold badges67 silver badges105 bronze badges

3 Comments

Haukman Over a year ago

Very good practice to use that instead yes (if he's using .NET 4)

foo ming xiang Over a year ago

yes im using it but i got a error saying that Error 10 'string' does not contain a definition for 'IsNullOrWhiteSpace'

Haukman Over a year ago

It's new for .NET 4. You can use IsNullOrEmpty, but it won't trim whitespace for you, so you have to do that manually.

Collectives™ on Stack Overflow

c# updating database problem

2 Answers 2

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related