Syntax Error in UPDATE Statement c#

Question

string co = "Update Accounts set password = '" + txtNew.Text + "'  where Username='" + txtUse.Text + "' and Password = '" + txtPas.Text + "'";

Above shows my UPDATE statement. There are no compiler errors or anything, not even any warnings.

Answer 1

I strongly suspect this happens because one of your TextBox values contains some of escaping characters like O'Connors or something. But since you didn't told their values, we can't be sure about that.

But more important, you should always use parameterized queries. This kind of string concatenations are open for SQL Injection attacks and you don't need to worry about escaping characters since prepared statements automatically handle them.

Also do not store your passwords as a plain text. Read: Best way to store password in database

using(var con = new OleDbConnection())
using(var cmd = con.CreateCommand())
{
   cmd.CommandText = @"Update Accounts set password = @newpass  
                       where Username = @user and Password = @pass";

   cmd.Parameters.Add("@newpass", OleDbType.VarWChar).Value = txtNew.Text;
   cmd.Parameters.Add("@user", OleDbType.VarWChar).Value = txtUse.Text;
   cmd.Parameters.Add("@pass", OleDbType.VarWChar).Value = txtPas.Text;

   con.Open();
   cmd.ExecuteNonQuery();
}

Answer 2

string co = "Update Accounts set password = '" + txtNew.Text + "'  where Username='" + txtUse.Text + "' and Password = '" + txtPas.Text + "'";

Above is your query and the Query contains password and Password.

Near to set you are given password and in where you are given Password