Click here to Skip to main content
15,885,435 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
I want to Update the XML data in My Application by using C#.When i trying Below code it does not raise any error,but in daTA BASE IT IS NOT UPDATED.PLE HELP ME..IT IS URGENT
private void button3_Click(object sender, EventArgs e)
    {

        XmlDocument doc1 = new XmlDocument();
        doc1.PreserveWhitespace = true;
        doc1.LoadXml(textBox2.Text);
        string qury = "update TableName set Column1='" + txt1.Text + "' where                       Column2='" + txt2.Text + "'";
        SqlCommand cmd = new SqlCommand(qury, con);
        SqlDataAdapter daaa = new SqlDataAdapter(cmd);
        MessageBox.Show("ok");

    }
Posted

Your code is vulnerable to SQL Injection[^].

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

You've also never executed your query, and never passed the XML to the query.

Try something like this:
C#
const string Query = "UPDATE TableName SET YourXmlColumn = @Xml WHERE YourOtherColumn = @Condition";
using (SqlCommand cmd = new SqlCommand(Query, con))
{
    cmd.CommandType = CommandType.Text;
    cmd.Parameters.AddWithValue("@Xml", textBox2.Text);
    cmd.Parameters.AddWithValue("@Condition", txt2.Text);
    
    con.Open();
    cmd.ExecuteNonQuery();
}

MessageBox.Show("ok");
 
Share this answer
 
Hi,

Change like this:

 private void button3_Click(object sender, EventArgs e)
        {
            
            XmlDocument doc1 = new XmlDocument();
            doc1.PreserveWhitespace = true;
            doc1.LoadXml(textBox2.Text);
            string qury = "update TableName set Column1='" + txt1.Text + "' where                       Column2='" + txt2.Text + "'";
string connetionString = null;
            SqlConnection connection;
            SqlDataAdapter adapter = new SqlDataAdapter();
            connetionString = "Data Source=ServerName;Initial Catalog=DatabaseName;User ID=UserName;Password=Password";
            connection = new SqlConnection(connetionString);
            
            try
            {
                connection.Open();
                adapter.UpdateCommand = connection.CreateCommand();
                adapter.UpdateCommand.CommandText = qury;
                adapter.UpdateCommand.ExecuteNonQuery();
                MessageBox.Show("Row updated !! ");
            }
 
        }


Try like this and you will get it be done.

Thanks & Regards
Sisir Patro
 
Share this answer
 
Comments
Richard Deeming 8-May-15 7:22am    
You have copied the SQL Injection[^] vulnerability from the question.

NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900