Updating Database Command in C#

Question

        using (MySqlCommand bb = new MySqlCommand("UPDATE  members SET  Begin = 1 WHERE id ='" + uid + "';"))
        {
            bb.Connection = con;
            con.Open();
            using (MySqlCommand fff = new MySqlCommand("UPDATE  members SET  b = 1 WHERE id ='" + uid + "';"))
            {
                fff.Connection = con;
            }
            this.Hide();
            Main main = new Main();
            main.Show();
        }

I'm trying to update both tables, B and Begin to 1 to the current logged in user (my uid command:

  using (MySqlCommand id = new MySqlCommand("SELECT id FROM members WHERE username='" + textBox1.Text + "';"))
                            {
                                id.Connection = con;
                                MySqlDataReader read3 = cmd.ExecuteReader();
                                read3.Dispose();
                                int idd = (int)id.ExecuteScalar();
                                uid = idd;
                                Begin.uid = idd;
                                MySqlDataReader read4 = id.ExecuteReader();
                                read4.Dispose();
                                id.Dispose();
                            }

I don't know why but it doesn't update the database.

Exactly What @GrantThomas said, and this command is vulnerable to "SQL Injection". And better yet, it's freaking 2013, stop using direct SQL!! use a entity framework, all this problems will go away.... — CarlosB
– CarlosB, Commented Jul 1, 2013 at 13:11

Darren · Accepted Answer · 2013-07-01 13:10:41Z

5

You're not executing the command.

You need fff.ExecuteScalar(); And bb.ExecuteScalar();

Or ExecuteNonQuery();

Also you are vulnerable to SQL Injection, try using paramerterized queries.

For instance:

 bb.CommandText = "UPDATE members SET  Begin = 1 WHERE id = @id";  
 bb.Parameters.AddWithValue("@id", id);
 bb.ExecuteNonQuery();

answered Jul 1, 2013 at 13:10

Darren

71.2k24 gold badges141 silver badges146 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Robert Vlasiu Over a year ago

Thanks! How can i make in unvulnerable to SQL inj?:) idk what are paramerterized queries.. xD

Darren Over a year ago

@VlasiuRobert - updated the answer to show you how to do this.

gzaxx · Accepted Answer · 2013-07-01 13:11:19Z

0

First of all user parametrized querys, second you do call ExecuteNonQuery() on any of your SqlCommands.

using (MySqlCommand bb = new MySqlCommand("UPDATE  members SET  Begin = 1 WHERE id = @id;"))
{
    bb.Parameters.AddWithValue("@id", uid);
    bb.Connection = con;
    con.Open();

    bb.ExecuteNonQuery();

    using (MySqlCommand fff = new MySqlCommand("UPDATE  members SET  b = 1 WHERE id = @id;"))
    {
        fff.Parameters.AddWithValue("@id", uid);
        fff.Connection = con;

        fff.ExecuteNonQuery();
    }

    this.Hide();
    Main main = new Main();
    main.Show();
}

answered Jul 1, 2013 at 13:11

gzaxx

17.6k2 gold badges40 silver badges55 bronze badges

Collectives™ on Stack Overflow

Updating Database Command in C#

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related