Updating Values with C# in SQL Table

Question

I was wondering if it is possible for the update button to save the changes made in the table. I wrote this code but I have no idea how it could possibly work

This is the code i wrote for the update button:

string conString = "Data Source=MIRANDA-PC;Initial Catalog=Futebol do Rosa;Integrated Security=True";
SqlConnection con = new SqlConnection(conString);
string selectSql = "Update Players$ set Player Name='" + dataGridView2.Text + "";
SqlCommand cmd = new SqlCommand(selectSql, con);
con.Open();

This is the table I want to update the values in:

enter image description here

Soner Gönül · Accepted Answer · 2015-01-20 12:55:56Z

4

Well, you just need to execute your query with ExecuteNonQuery.

But more important, you should always use parameterized queries. This kind of string concatenations are open for SQL Injection attacks.

Also use using statement to dispose your SqlConnection and SqlCommand.

And if your table or column names more than one word, you need to use them with [] as [Player Name]. And honestly, it is a little bit weird to use $ sign in a table name.

using(SqlConnection con = new SqlConnection(conString))
using(SqlCommand cmd = con.CreateCommand())
{
    cmd.CommandText = "Update Players$ set [Player Name] = @name";
    cmd.Parameters.Add("@name", SqlDbType.NVarChar, 16).Value = dataGridView2.Text;
    con.Open();
    cmd.ExecuteNonQuery();
}

edited Jan 20, 2015 at 12:55

answered Jan 20, 2015 at 12:44

Soner Gönül

99.1k103 gold badges224 silver badges375 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

jungyh0218 · Accepted Answer · 2015-01-20 12:55:37Z

1

You have to execute your SQL query with your db object.

dbinstance.ExecuteSqlCommand(string sqlcommand, object[] params);

This method is both for DDL and DML. you can also use ExecuteNonQuery method.

edited Jan 20, 2015 at 12:55

answered Jan 20, 2015 at 12:49

jungyh0218

5681 gold badge4 silver badges18 bronze badges

Comments

Mohamed Saeed · Accepted Answer · 2015-01-20 12:58:06Z

0

 cmd.CommandText = "Update Players$ set [Player Name] = @Playername";
    cmd.Parameters.Add("@Playername", SqlDbType.NVarChar, 16).Value = dataGridView2.Text;
    con.Open();
    cmd.ExecuteNonQuery();

answered Jan 20, 2015 at 12:58

Mohamed Saeed

7411 bronze badges

Comments

Gil Cohen · Accepted Answer · 2015-01-20 21:18:03Z

0

The best solution (if possible) to to convert your DAL (Data Access Layer) to Entity-framework based, instead of writing your own SQL queries. This is safe-by-design and never is vulnerable to SQL Injection of any kind. Here is some mockup code:

using (AppEntities currDb = new AppEntities)
{
    Players PlayerToEdit =
    from player in currDb.Players
    where player.PlayerID == lngPlayerID
    select player.First();

    PlayerToEdit.PlayerName = dataGridView2.Text;
    currDb.SaveChanges();
}

You can read about it some more here: https://msdn.microsoft.com/en-us/data/ef.aspx

answered Jan 20, 2015 at 21:18

Gil Cohen

8467 silver badges12 bronze badges

Collectives™ on Stack Overflow

Updating Values with C# in SQL Table

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related