0

i have my project, access oracle database from my visual c# i have trouble using update command

here my code

string updatetodb = "update tugas_oop ";
updatetodb += "set stok = :i_stok, ";
updatetodb += "dana_keluar = :i_dana_keluar ";
updatetodb += "where nama_barang = '" + nama_barang[i] + "' and satuan = '" + satuan[i] + "';";

cmd.CommandText = updatetodb;

OracleParameter istok = new OracleParameter();
istok.OracleDbType = OracleDbType.Int32;
istok.Value = updatestok;
istok.ParameterName = "i_stok";

OracleParameter idana_keluar = new OracleParameter();
idana_keluar.OracleDbType = OracleDbType.Int32;
idana_keluar.Value = updatedanakeluar;
idana_keluar.ParameterName = "i_dana_keluar";

cmd.Parameters.Add(istok);
cmd.Parameters.Add(idana_keluar);
cmd.ExecuteNonQuery();

and i got error message ora-00911 can you tell me, where i made mistake?

Tomtom
  • 9,087
  • 7
  • 52
  • 95
alfianabdi
  • 29
  • 1
  • 1
  • 3
  • Why are you only partially using parameters? `nama_barang[i]` and `satuan[i]` should also be parameterised. – GarethD Jan 31 '13 at 12:55
  • have u heard of stored Procedures ? read on those – Ravi Gadag Jan 31 '13 at 12:56
  • What are the values of upatestok and updatedanakeluar? Is this your exact code? Unless you explicitly set the `BindByName` property of the commnand to true the names of the parameters are irrelevant, and they are bound by position. See [this question](http://stackoverflow.com/q/3876856/1048425) for more details on this – GarethD Jan 31 '13 at 14:09

1 Answers1

0

Replace with 

istok.ParameterName = ":i_stok";

idana_keluar.ParameterName = ":i_dana_keluar";

i suggest you to use string.Format (Ensure that you don't have problem about quote)

string.Format("update tugas_oop set stok = :i_stok, dana_keluar = :i_dana_keluar where nama_barang = {0} and satuan = {1}",nama_barang[i],satuan[i]);

Note : For me i prefer use stored procedure in order to validate your query before calling

Aghilas Yakoub
  • 28,516
  • 5
  • 46
  • 51
  • Why would you suggest using `string.Format` over additional parameters? Parameters not only prevent [SQL Injection](http://bobby-tables.com/), they also remove chances of conversion errors, or data truncation, and separate code from data for easier readability. – GarethD Jan 31 '13 at 13:21
  • I mean why would you not suggest using parameters for nama_barang as well as i_stok and i_dana_keluar. i.e make the SQLCommand `update tugas_oop set stok = :i_stok, dana_keluar = :i_dana_keluar where nama_barang = :i_nama_barang and satuan = :i_satuan`, then add parameters to the command using `command.Parameters.Add("i_nama_barang", nama_barang[i]);` – GarethD Jan 31 '13 at 14:07
  • Ok ok i inderstand your remark GarethD, thank's for precision – Aghilas Yakoub Jan 31 '13 at 14:22