Sending textbox value to sql database

Question

There is a textbox called tbTodo, which gets information from the database:

SELECT `todo` FROM `user` WHERE `username` LIKE '" + _naam + "'";

which works. The problem now is, i have no idea how to update the todo list in the database: how to send the textbox value and overwrite the one from the database. Code i have so far (which could be totally wrong):

db_connection();
        MySqlCommand cmdRead = new MySqlCommand();
        cmdRead.CommandText = "SELECT `todo` FROM `user` WHERE `username` LIKE '" + _naam + "'";
        cmdRead.Connection = connect;
        MySqlDataReader tdOphalen = cmdRead.ExecuteReader();
        if (tdOphalen.Read())
        {
            tbTodo.Text = tdOphalen.GetString(0);
            connect.Close();
            return true;
        }
        else
        {
            connect.Close();
            return false;
        }
    }

Well, if you want to update the database, then you'll need to use an UPDATE command instead of a SELECT command... — David
– David, Commented Sep 16, 2016 at 17:06
First of all: do NOT use SQL query strings like that unless you want people to perform SQL injection and harm your database; use a prepared statement. Second, what is it you are trying to update in the database? I understand it's a todo list but what columns are you trying to update and with what information? — willwolfram18
– willwolfram18, Commented Sep 16, 2016 at 17:09
@Bwolfing For now, it is just a textbox, for a personal project. I have no idea what you mean with prepared statement. I am new to sql. Sorry for my lack of knowlenge, but could you please explain what i should do? — Tjazz
– Tjazz, Commented Sep 16, 2016 at 17:17
Take a look at the SQL Injection, prepared statement, and Exploits of a Mom link from @Filburt to understand the dangers of your query first :) — willwolfram18
– willwolfram18, Commented Sep 16, 2016 at 17:18

thiago · Accepted Answer · 2016-09-16 17:25:08Z

1

syntax of UPDATE command is

UPDATE table_name
SET column1=value1,column2=value2,...
WHERE some_column=some_value;

In your case it would be something like

"UPDATE `user` set `todo` = '" + tbTodo.Text + "' FROM `user` WHERE `username` LIKE '" + _naam + "'";

It should be good for a first try and learn how update values on a database.

Next steps is learn how to use prepared statement ;)

answered Sep 16, 2016 at 17:25

thiago

193 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Tjazz Over a year ago

It kinda works? i guess? So i copied your code in my code, and i get an error at line: MySqlDataReader tdOphalen = cmdRead.ExecuteReader(); which says:Additional information: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'FROM user WHERE username LIKE '<name>'' at line 1 Idea how to fix? Btw, sorry for my lack of knowledge, since i am new

willwolfram18 Over a year ago

You're using ExecuteReader which allows read-only operations. Use ExecuteNonQuery instead.

Collectives™ on Stack Overflow

Sending textbox value to sql database

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related