modify data in columns in SQL Server

Question

I am trying to make a website written in C# in Visual Studio 2010. I got a database in .accdb extention.

So I go a table in the database called usertb, and in the table username is the key, and the data password and DOB in columns.

Now I need to make a function to edit a user profile, which lets the user to enter a new password and Date of Birth. After that, it will save to the database.

I don't know why the code seems to be not working. I tried to use

UPDATE ... SET ...WHERE ..

function but I don't know why it doesn't allow me to do that (is that because my code is written in C# but not PHP?)

Here is the code for edit user profile: (srpassword is the name of the password column, password is the new one user typed in)

public static bool EditUserInfo(string username, string password)
{
    string query = "SELECT REPLACE([srpassword], [srpassword], 'password')
                    FROM usertb WHERE srusername = '" + username + "'";
    accessDB dbaccess = new accessDB();
    return dbaccess.saveData(query);
}

Hope somebody can help me

Damian Leszczyński - Vash · Accepted Answer · 2011-05-10 09:09:04Z

3

The syntax select replace is from MySQL, in SQL Server the update statements goes like this

Also I'm no sure about that accessDB dbaccess = new accessDB();, has the connection etc.

Also instead of combining statement you should use parameters, then your statement should look like this.

UPDATE usertb SET srpassowr = @password WHERE srusername = @userName;

As you have some class responsible for connection to db this example show how usually sql statemetns should be executed.

answered May 10, 2011 at 9:09

Damian Leszczyński - Vash

31k9 gold badges64 silver badges95 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Vladislav Zorov · Accepted Answer · 2011-05-10 09:01:40Z

1

Did you try "UPDATE usertb SET [srpassword] = '" + password + "' WHERE [srusername] = '" + username + "'?

I'm not going in details why Access is a bad choice, if you're using it only for prototyping it should be OK though.

answered May 10, 2011 at 9:01

Vladislav Zorov

3,05621 silver badges32 bronze badges

3 Comments

JTorrecilla Over a year ago

Vladislav, I think that @Vash option is better because use Parameters instead of concat values to the query...

Vladislav Zorov Over a year ago

Of course it's better, I was just trying not to complicate things too much (for now). First get it working, then make it robust :)

Vladislav Zorov Over a year ago

You're welcome, now take a look at the other answer or search in google: "c# parametrized query" :) Believe me, not only will it make your code more readable, but also much more secure (SQL injection becomes impossible) and fast (i.e. if you reuse the same query in a loop).

Collectives™ on Stack Overflow

modify data in columns in SQL Server

2 Answers 2

Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related