Click here to Skip to main content
15,066,928 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:

Hopefully, someone can set me on the right track, I am officially confused...

I have two forms (form1) and (form2), in form1, I have a DataGridVied, named dgvLøyvehaver.
When I double click on a row in the DataGridView, it opens up form2 with the content of that row inserted into textboxes.
Then I tried to write code so that I could edit the textboxes and it would update the DataGridView-row.

Well.. it works... kinda.

Here's my code:

using (SqlConnection sqlCon = new SqlConnection(ConnectionString.connectionString))
using (SqlCommand sqlCom = new SqlCommand()) {

    sqlCom.Connection = sqlCon;

    var firstForm = Application.OpenForms.Cast<Form>().First();
    DataGridView dgv = (DataGridView)firstForm.Controls["dgvLøyvehaver"];

    dgv.CurrentRow.Cells[1].Value = txtForetaksnavn.Text.ToString();
    dgv.CurrentRow.Cells[2].Value = txtForetaksnummer.Text.ToString();
    dgv.CurrentRow.Cells[3].Value = txtAdresse.Text.ToString();
    dgv.CurrentRow.Cells[4].Value = txtPostnummer.Text;
    dgv.CurrentRow.Cells[5].Value = txtPoststed.Text.ToString();
    dgv.CurrentRow.Cells[6].Value = txtBIC.Text.ToString();
    dgv.CurrentRow.Cells[7].Value = txtIBAN.Text.ToString();

sqlCom.CommandText = ("INSERT INTO Løyvehaver2 (Foretaksnavn, Foretaksnummer, Adresse, Postnummer, Poststed, BIC, IBAN) " + "VALUES ('" + txtForetaksnavn.Text + "','" + txtForetaksnummer.Text + "','" + txtAdresse.Text + "','" + txtPostnummer.Text + "','" + txtPoststed.Text + "','" + txtBIC.Text + "','" + txtIBAN.Text + "')");

What I have tried:

So, yes, this changes the data of the row as I want. Seems fine!
But if I afterwards update my DataGridView, the original row re-appears (as it was before I edited it), and the edited version is put into a whole new row!

What am I missing?

Any advice would be greatly appreciated! Thanks!
Updated 6-May-21 11:11am

1 solution

First off, don't do it like that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
A perfectly valid "delete the table" command
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

Then when that's fixed through your whole app you can start on teh problem you have noticed...

Exactly how you pass the info depends on the "relationship" between the two forms.
Have a look at these, one of them will fit your circumstances.
The form that creates an instance of another:
MyForm mf = new MyForm();
Is the "parent", the other form is the "child".
(This doesn't imply any formal MDI relationship)

Transferring information between two forms, Part 1: Parent to Child[^]
Transferring information between two forms, Part 2: Child to Parent[^]
Transferring information between two forms, Part 3: Child to Child[^]
Maciej Los 7-May-21 5:20am

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900