1

Hi I've been struggling to find what I did wrong but can't seem to find it and I was hoping if you could help me. Here is the code

protected void Button3_Click(object sender, EventArgs e) {

            Random r = new Random();
            int num = r.Next(1,10);

            var GUsername = Session["U_Email"].ToString();
            conn.Open();
            query = "";
            query = "INSERT INTO [CartForDelivery] (OR,User_Email,Date,Date_To_Deliver,TotalPayment,P_Print) VALUES ('" + num + "','" + GUsername + "','" + DateTime.Now.ToString("MM/dd/yyyy") + "','" + DateTime.Now.AddDays(2).ToShortDateString() + "','" + lblmsg.Text + "','NP')";
            SqlCommand cmd = new SqlCommand(query, conn);
            cmd.ExecuteNonQuery();
            conn.Close();

            for (int i = 0; i <= GridView1.Rows.Count - 1; i++)
            {

                Label gvr = (Label)GridView1.Rows[i].Cells[1].FindControl("lblname");

                conn.Open();
                SqlCommand ddcmd = new SqlCommand("update [B_Products] set OR = '" + num + "', Status = 'Complete', P_Print = 'NP' where User_Email = '" + GUsername + "' AND Date ='" + DateTime.Now.ToString("MM/dd/yyyy") + "' and Status = 'Pending' and Products = '" + gvr.Text + "'", conn);
                ddcmd.ExecuteNonQuery();
                conn.Close();
                update();
                //S Response.Redirect("ThanksC.aspx");

            }

    }

I check if its because no data is added to my OR, but my random generator seems to be working fine, below image is how I checked it enter image description here

the error is highlighting cmd.ExecuteNonQuery(); and saying Incorrect syntax near the keyword 'OR'.

  • 2
    OR is a *reserved* word. It must be quotes as an identifier: `"OR"` (ANSI, and SQL Server); SQL Server understands `[OR]` as well. MySQL uses `'OR'` (and `"OR"` with the right settings).. *sigh* .. anyway, since you're using SQL Server (as indicated by other quoted identifiers), use `[OR]`. – user2864740 Dec 01 '18 at 05:11
  • 1
    In addition, it would be good to *use placeholders* to 1) make the query easier to read and 2) more importantly, avoid SQL injection (accidental or otherwise). - https://stackoverflow.com/q/332365/2864740 – user2864740 Dec 01 '18 at 05:13
  • Ref. https://stackoverflow.com/q/7505808/2864740 – user2864740 Dec 01 '18 at 05:19
  • ok tnx :) I'll try it now – PandaPlay123 Dec 01 '18 at 05:33
  • 1
    what you said was right gosh thank you so much! – PandaPlay123 Dec 01 '18 at 05:36

0 Answers0