0

I have been building my dad a payroll/accounting program to save him the time and hustle of using Excel, might as well just go back to pen and paper. I got everything ready and in a primitive way is raw but user-friendly, but still can't seem to get the "update query" correct. I do have an Azure account which I'm currently using for "Cloud Database" access.

I have tried several ways:

//This is not the complete codes I have used.
newDataRow.Cells[0].Value = regYTD.Text;
string query = "UPDATE employeeInfo SET..."
/////////////////////////////////////////////

private void stubDbBtnUpdate_Click(object sender, EventArgs e)
{     
      //This is what I am currently using. 
      con.Open(); 
      string query = "UPDATE EmployeeInfo SET [Address Line 1] = '" + employeeAddress1.Text + "', [Address Line 2] = '" + employeeAddress2.Text + "', [City] = '" + employeeCity.Text + "', " +
                       "[State] = '" + employeeState.Text + "', [Zip] = '" + employeeZip.Text + "', [Phone] = '" + employeePhone.Text + "', " +
                       "[SSN] = '" + employeeSSN.Text + "', [Regular Earnings-YTD] = '" + regYTD.Text + "', " +
                       "[Overtime Earnings-YTD] = '" + ovrYTD.Text + "', [Total Earnings-YTD] = '" + totYTD.Text + "', [Federal-YTD] = '" + fedYTD.Text + "', " +
                       "[State-YTD] = '" + stYTD.Text + "', [Social-YTD] = '" + ssYTD.Text + "', [MediCare-YTD] = '" + medCareYTD.Text + "', " +
                       "[Total Deductions-YTD] = '" + deduYTD.Text + "',[Net Pay-YTD] = '" + netYTD.Text + "' ";
      SqlDataAdapter dataAdapter = new SqlDataAdapter(query, con);
      dataAdapter.SelectCommand.ExecuteNonQuery();
      con.Close();
 }

So far they have not given me an error either saying incorrect syntax or incorrect input, but using the newDataRow.Cell updates the desired cells locally only. This code updates correctly (up to the cloud) but it also updates the rest of the cells with the same [Name].

Dale K
  • 25,246
  • 15
  • 42
  • 71
Oz3HI
  • 1
  • 1
  • Why are you injecting all of your values? Before anything you **need** to parametrise that query (using `Parameters.Add`). That statement is a SQL Injection nightmare. – Thom A May 30 '19 at 09:33
  • 1
    You need a `WHERE` clause on the query to update the row for the chosen primary key. You are also using a select command to do an update. [Take a look at this sample application](https://github.com/crowcoder/CSharpCrudGrid) that will show you how to do this with ADO.Net. – Crowcoder May 30 '19 at 09:33
  • Just a Suggestion try using parameterized queries [Why prefer Parameterized Queries](https://stackoverflow.com/questions/7505808/why-do-we-always-prefer-using-parameters-in-sql-statements). And also as @Crowcoder suggested always have a `Where` clause assigned to your `Update` query or else it will be **Complete Table Update**. – vikscool May 30 '19 at 09:34

0 Answers0