How can I pass label value inside the field

Question

var conString = ConfigurationManager.ConnectionStrings["CONSTRING"].ConnectionString;
SqlConnection con = new SqlConnection(conString);
string uname = Session["un"].ToString();
Label sid = (Label)DetailsView1.Rows[1].Cells[1].Controls[0].FindControl("lblsid");
TextBox nam = (TextBox)DetailsView1.Rows[2].Cells[1].Controls[0].FindControl("lblname");
TextBox lnam = (TextBox)DetailsView1.Rows[3].Cells[1].Controls[0].FindControl("lbllname");
TextBox cont = (TextBox)DetailsView1.Rows[4].Cells[1].Controls[0].FindControl("lblcon");
TextBox ei = (TextBox)DetailsView1.Rows[5].Cells[1].Controls[0].FindControl("lblei");
TextBox add = (TextBox)DetailsView1.Rows[6].Cells[1].Controls[0].FindControl("lbladd");
TextBox cit = (TextBox)DetailsView1.Rows[7].Cells[1].Controls[0].FindControl("lblcit");
DropDownList typ = (DropDownList)DetailsView1.Rows[8].Cells[1].Controls[0].FindControl("lbltyp");
cmd.Connection = con;
cmd.CommandText = "update seller set  fname ='" + nam.Text + "',  lname ='" + lnam.Text + "', contact ='" + cont.Text + "', address ='" + add.Text + "', city ='" + cit.Text + "', type='" + typ.SelectedValue + "' where sid=" + sid.Text + "";
cmd.Connection.Open();

cmd.ExecuteNonQuery();

DetailsView1.ChangeMode(DetailsViewMode.ReadOnly);
BindData();

I know this way is to find the control but I dont know how to pass Sid value in the query. can some one help? working on C#

For future reference: [Exploit of a Mom](http://stackoverflow.com/questions/332365/how-does-the-sql-injection-from-the-bobby-tables-xkcd-comic-work) — Steve, Dec 03 '16 at 14:57
@ChrisF looks like ASP.Net WebForms with a datagrid or a gridview — Simon Price, Dec 03 '16 at 14:59

score 0 · Accepted Answer · answered Dec 03 '16 at 15:10

Use parameters. Below I am showing you how to do so for first name. You can do the rest like this.

SqlCommand cmd = new SqlCommand(
    "update seller set  fname = @firstName", con);

// 2. define parameters used in command object
SqlParameter param = new SqlParameter();
param.ParameterName = "@firstName";
param.Value = nam;

// 3. add new parameter to command object
cmd.Parameters.Add(param);

How can I pass label value inside the field

1 Answers1