Click here to Skip to main content
15,900,511 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
its giving me syntax error please help me i dont know the problem
C#
con.Open();
            OleDbCommand cmd = con.CreateCommand();
            cmd.CommandType = CommandType.Text;
            cmd.CommandText = "update product set LastName=@LastName,FirstName=@FirstName,MiddleName=@MiddleName,Section=@Section where StudentID=@StudentID";
            cmd.Parameters.Clear();
            cmd.Parameters.AddWithValue("@LastName", TextBox1.Text);
            cmd.Parameters.AddWithValue("@FirstName", TextBox2.Text);
            cmd.Parameters.AddWithValue("@MiddleName", TextBox3.Text);
            cmd.Parameters.AddWithValue("@Section", TextBox4.Text);
          //  cmd.Parameters.AddWithValue("@StudentID", TextBox5.Text);
            cmd.ExecuteNonQuery();


What I have tried:

i dont know the problem

C#
con.Open();
            OleDbCommand cmd = con.CreateCommand();
            cmd.CommandType = CommandType.Text;
            cmd.CommandText = "UPDATE product SET LastName='" + TextBox1.Text+ "',FirstName='" + TextBox2.Text + "',MiddleName='" + TextBox3.Text + "',Section='"+TextBox4.Text+"' where StudentID=" + TextBox5.Text + "";
            cmd.ExecuteNonQuery();
            this.Refresh();

            con.Close();
this is my first code
Posted
Updated 3-Nov-18 0:13am
v2

1 solution

The good thing is that you have got rid of the concatenated text version - that is very dangerous!

The next thing to do is find out when you get "a syntax error" - and I'm guessing it's at runtime not compile time, which means it's a problem with the SQL command.
And that means it's likely to be the named parameters, which an OleDbConnection doesn't support in the same way as an SqlConnection.
Because you name a parameter in your query, but comment it out in your cmd.Parameters.AddwithValue list, tejh command processor is probably complainign about the "<pre>where StudentID=@StudentID</pre>" becuase @StudentID will be replaced with a NULL and that's probably the problem

Uncomment the line, and it should work:
cmd.CommandText = "update product set LastName=@LastName,FirstName=@FirstName,MiddleName=@MiddleName,Section=@Section where StudentID=@StudentID";
cmd.Parameters.Clear();
cmd.Parameters.AddWithValue("@LastName", TextBox1.Text);
cmd.Parameters.AddWithValue("@FirstName", TextBox2.Text);
cmd.Parameters.AddWithValue("@MiddleName", TextBox3.Text);
cmd.Parameters.AddWithValue("@Section", TextBox4.Text);
cmd.Parameters.AddWithValue("@StudentID", TextBox5.Text);
cmd.ExecuteNonQuery();
But do remember that the names are irrelevant in OldDb, and can be replaced with placeholders - the order in which they are added controls where they go!
cmd.CommandText = "UPDATE product SET LastName=@LastName, FirstName=?, MiddleName=?, Section=? WHEREStudentID=?";
cmd.Parameters.Clear();
cmd.Parameters.AddWithValue("@LastName", TextBox1.Text);
cmd.Parameters.AddWithValue("@FirstName", TextBox2.Text);
cmd.Parameters.AddWithValue("@MiddleName", TextBox3.Text);
cmd.Parameters.AddWithValue("@Section", TextBox4.Text);
cmd.Parameters.AddWithValue("@StudentID", TextBox5.Text);
cmd.ExecuteNonQuery();
 
Share this answer
 
Comments
Member 14042406 3-Nov-18 6:42am    
i uncomment the line but its still giving me syntax error
OriginalGriff 3-Nov-18 6:54am    
So show us exactly the code you are using and the full text of the error.
Member 14042406 3-Nov-18 7:05am    
con.Open();
OleDbCommand cmd = con.CreateCommand();
cmd.CommandType = CommandType.Text;
cmd.CommandText = "UPDATE product SET LastName=@LastName, FirstName=@FirstName, MiddleName=@MiddleName, Section=@Section WHERE StudentID="+TextBox5.Text+"";
cmd.Parameters.Clear();
cmd.Parameters.AddWithValue("@LastName", TextBox1.Text);
cmd.Parameters.AddWithValue("@FirstName", TextBox2.Text);
cmd.Parameters.AddWithValue("@MiddleName", TextBox3.Text);
cmd.Parameters.AddWithValue("@Section", TextBox4.Text);

cmd.ExecuteNonQuery();
i remove the parameters of StudentID and i replace the where StudentID=@StudentID to StudentID="+Textbox5.Text+"
OriginalGriff 3-Nov-18 7:11am    
And now I can destroy your database at will.
Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
DROP TABLE MyTable;
A perfectly valid "delete the table" command
--'
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900