Click here to Skip to main content
15,886,075 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I've trying to do some kind of mysql command that could check the value from a datagridview selected row and then update it if it was equal to 1. So far i got this piece of code, but i can't figure it out how to setup the sql sintax correctly.

C#
namespace WindowsFormsApplication1
{
    public partial class Emp_gerir_val : Form
    {
        public Emp_gerir_val()
        {
            InitializeComponent();
        }

        private void chkVerArq_CheckedChanged(object sender, EventArgs e)
        {
            
            MySqlDataAdapter sda = new MySqlDataAdapter();
            MySqlConnection Con = new MySqlConnection("server=localhost;user id=root; password = 12345; persistsecurityinfo=True;database=portaria");
            DataTable dt = new DataTable();

            if (chkVerArq.Checked == true)
            {
                MySqlCommand Command = new MySqlCommand("SELECT nome_empresa, arquivo from empresas WHERE arquivo= 1;", Con);
                sda.SelectCommand = Command;
                sda.Fill(dt);
                DgvGerirEmp.DataSource = dt;
                GerirEmpArq.Hide();
                GerirEmpDesArq.Show();

            }
            else
            {
                MySqlCommand Command = new MySqlCommand("SELECT nome_empresa, arquivo from empresas WHERE arquivo= 0;", Con);
                sda.SelectCommand = Command;
                sda.Fill(dt);
                DgvGerirEmp.DataSource = dt;
                GerirEmpArq.Show();
                GerirEmpDesArq.Hide();
                
            }
            

        }


        public void Emp_gerir_val_Load(object sender, EventArgs e)
        {
            MySqlDataAdapter sda = new MySqlDataAdapter();
            MySqlConnection Con = new MySqlConnection("server=localhost;user id=root; password = 12345; persistsecurityinfo=True;database=portaria");
            MySqlCommand Command = new MySqlCommand("SELECT nome_empresa, arquivo from empresas WHERE arquivo= 1;", Con);
            DataTable dt = new DataTable();
            sda.SelectCommand = Command;
            sda.Fill(dt);
            GerirEmpArq.Show();

            try
            {
                Con.Open();


                DataView dv = new DataView(dt);
                DgvGerirEmp.DataSource = dv.Table;
                DgvGerirEmp.AutoGenerateColumns = true;
                
                Con.Close();
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message);
            } 

        }

        private void GerirEmpArq_Click(object sender, EventArgs e) 
        {
            MySqlDataAdapter sda = new MySqlDataAdapter();
            MySqlConnection Con = new MySqlConnection("server=localhost;user id=root; password = 12345; persistsecurityinfo=True;database=portaria");
            DataTable dt = new DataTable();

            MySqlCommand Command = new MySqlCommand("Update empresas set arquivo = 1 where nome_empresa = '" + this.NomeEmpTxt.Text + "' ;", Con);
     

            
        }

        private void DgvGerirEmp_CellContentClick(object sender, DataGridViewCellEventArgs e)
        {
            if (e.RowIndex >= 0)
            {
                
                DataGridViewRow row = this.DgvGerirEmp.Rows[e.RowIndex];
                NomeEmpTxt.Text = row.Cells[0].Value.ToString();
                
            }
        }

        private void GerirEmpDesArq_Click(object sender, EventArgs e)
        {

        }
    }
}



Table:

+---------------+--------------+----------+
| nome_empresa | id_empresa | arquivo |
|Test Company 0 | 1 | 0 |
|Test Company 1 | 2 | 1 |
|Test Company 2 | 3 | 1 |
|Test Company 3 | 4 | 0 |
|Test Company 4 | 5 | 0 |


As you can see i got on the column Arquivo some ids that got 0 and other got 1, that means "is the id archived?" 1 for yes and 0 for no. With that in mind i want some kind of help on this stuff. For example, i got this row selected(the one underlined) and i want to change the "arquivo value which is 0 to 1, but how can i do it on a UPDATE sintax? That's my question.
Posted
Updated 20-Jan-16 3:16am
v2
Comments
Richard Deeming 20-Jan-16 9:42am    
Your code is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.
Scribling Doodle 20-Jan-16 10:21am    
That didn't respond to my question, thanks anyway for the advice!
Richard Deeming 20-Jan-16 10:24am    
That's why I posted it as a comment, not an answer.

Just because it doesn't answer your question, don't dismiss it. Your code contains an extremely serious security vulnerability, and you need to fix it ASAP. And not just in this code block - you need to go back through all of your code to check for SQL Injection, and fix everything you find.
Scribling Doodle 20-Jan-16 10:53am    
Thanks for the advice, i've figured it out how to fix the 2 problems on the same way.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900