When i click the update button to update database values in SQL C# All Rows Are Affected by the same value

Question

Bellow Is My Code For Update Button Click Event!

    {
        try
    {

        con = new SqlConnection(cs.ConDB);
        con.Open();
        string cb = "Update tblFees set Salutation= '" + cmbSalutation.Text + "' , Name= '" + tbName.Text + "',Sex = '" + cmbSex.Text + "', Date ='" + Date.Text + "',Fees_Amount='" + cmbFeesAmount.Text + "',Fees_Status='" + radioButton1.Checked + "'";
        cmd = new SqlCommand(cb);
        cmd.Connection = con;
        cmd.ExecuteReader();
        con.Close();
        MessageBox.Show("Successfully updated", "Record", MessageBoxButtons.OK, MessageBoxIcon.Information);

        btnUpdate.Enabled = false;
        btnSave.Enabled = true;
    }
    catch (Exception ex)
    {
        MessageBox.Show(ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
    }
    try
    {
        con = new SqlConnection(cs.ConDB);
        con.Open();
        cmd = new SqlCommand("SELECT * From tblFees", con);
        SqlDataAdapter myDA = new SqlDataAdapter(cmd);
        DataSet myDataSet = new DataSet();
        myDA.Fill(myDataSet, "tblFees");
        dataGridView1.DataSource = myDataSet.Tables["tblFees"].DefaultView;
        con.Close();


    }catch (Exception ex)
        {
MessageBox.Show(ex.Message, "Error", MessageBoxButtons.OK,                          MessageBoxIcon.Error);}`

Please Solve my problem i am new in the programming world any help would be greatly appreciated

you should really use parameterized queries, concatenating strings can allow SQL injection attacks. see this answer for more info: http://stackoverflow.com/questions/7505808/using-parameters-in-sql-statements — Jay, Oct 13 '15 at 07:03
un-lucky sir, please give me some example I am a beginner in programming ... — Niha Sharma, Oct 13 '15 at 07:05
Yes i want to update table based on Name ,Dear please help me... — Niha Sharma, Oct 13 '15 at 07:07

score 0 · Answer 1 · edited Oct 13 '15 at 07:41

you should specify the rows using where condition

For example you can modify your query something like the following. I assume cboUser is a combo box there you can select particular user, so that the data updated for that selected user only.

SqlConnection con = new SqlConnection();
con.Open();
string cb = "Update [tblFees] set Salutation=@Salutation, Name=@Name,Sex =@Sex where tblFeesPK=@pk'";
SqlCommand cmd = new SqlCommand(cb, con);
cmd.Parameters.AddWithValue("@Salutation", cmbSalutation.Text);
cmd.Parameters.AddWithValue("@Name", tbName.Text);
cmd.Parameters.AddWithValue("@Sex", cmbSex.Text);
cmd.Parameters.AddWithValue("@pk", cboUser.SelectedValue);
cmd.ExecuteNonQuery();

If you want to update details based on name means: you can give name in where condition. but it's not a proper way. so use primary key(since name may have duplicate values)

Waqar Ahmed · Answer 2 · 2015-10-13T07:13:11.843

-2

You need to change the statement as:

string cb = "Update tblFees set Salutation= '" + cmbSalutation.Text + "' , Name= '" + tbName.Text + "',Sex = '" + cmbSex.Text + "', Date ='" + Date.Text + "',Fees_Amount='" + cmbFeesAmount.Text + "',Fees_Status='" + radioButton1.Checked + "' where Name= '" + tbName.Text + "'";

You need to add where Name= '" + tbName.Text + "';

Now it will update those rows where Name matches

Also as un-lucky said u should use parameterized queries

edited Oct 13 '15 at 07:13

answered Oct 13 '15 at 07:08

Waqar Ahmed

1,414
2
15
35

Oh god...! this opens a wide way of injection – sujith karivelil Oct 13 '15 at 07:09
I know she needs a solution in her own way! – Waqar Ahmed Oct 13 '15 at 07:09
Dude what she asked is that she doesn't want to update all records. She haven't said anything about different approach. I am answering her DIRECT TO THE POINT :) – Waqar Ahmed Oct 13 '15 at 07:11
Thanks to both un-lucky & Waqar Ahmed i will try on this,,,, :) – Niha Sharma Oct 13 '15 at 07:12
So i am new to programming give me suggestions that good for me from all angles ... thanks to everyone again :) – Niha Sharma Oct 13 '15 at 07:15
1

But certain questions shouldn't be answered "direct to the point", because they indicate a fundamentally wrong-headed approach to problem solving. See [Pounding a Nail: Old shoe or glass bottle](http://weblogs.asp.net/alex_papadimoulis/408925) by Alex Papadimoulis for a humorous example. – Damien_The_Unbeliever Oct 13 '15 at 07:29

When i click the update button to update database values in SQL C# All Rows Are Affected by the same value

2 Answers2