Click here to Skip to main content
15,907,906 members
Please Sign up or sign in to vote.
2.00/5 (1 vote)
hi!! i am getting Syntax Error in Update Statement

the values are provided by clicking a cell in datagridview...


SQL
OleDbCommand cmd = new OleDbCommand("update from Purchases SET '" + name_of_column + "' ="  + new_val + " WHERE '" + name_of_column + "' ="  + cellvalue, con);



can someone please help me with this...

Thanks in Advance.. :)
Posted

"from" is not used in "UPDATE" statement.

OleDbCommand cmd = new OleDbCommand("Update Purchases SET '" + name_of_column + "' ="  + new_val + " WHERE '" + name_of_column + "' ="  + cellvalue, con);


The way you are concatenating user input instead of using OleDbParameter class leaves your program susceptible to SQL Injection Attack. Using an SQL Injection Attack, a nefarious individual could erase or damage your database.
 
Share this answer
 
The reason behind this syntax error is in your upadate query. you are passing your table name as a string value with single quotes and the value without single quotes.
Rewrite your code like this:
C#
OleDbCommand cmd = new OleDbCommand("update Purchases SET " + name_of_column + " ='"  + new_val + "' WHERE " + name_of_column + " = '"  + cellvalue + "', con);
 
Share this answer
 
v2
i think u dont need to put the word from in the commandString
i.e. ur command was:
OleDbCommand cmd = new OleDbCommand("update from Purchases SET '" + name_of_column + "' ="  + new_val + " WHERE '" + name_of_column + "' ="  + cellvalue, con);

but it must be
OleDbCommand cmd = new OleDbCommand("update Purchases SET '" + name_of_column + "' ="  + new_val + " WHERE '" + name_of_column + "' ="  + cellvalue, con);
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900