SQL command for update in C#

Question

I've been having a lot of trouble with these simple lines of code. I tried fixing it many times, but I don't seem to get it. I hope someone can help me with this.

SqlCommand cmd = new SqlCommand("UPDATE dbo.Status SET Status = "<span class=\"label label-success\">Success</span>" WHERE ActivateMember = " +i + "", 
                                mydatabase.cn);

The problem is I'm unable to execute that SqlCommand in C# but I'm able to execute it as a SQL query.

Right now the error is

Unexpected character '\'

You need to surround the value with single quotes: "'<span class=\"label label-success\">Success</span>'" but you should really use parameterized queries instead to prevent SQL injection attacks. — Sani Huttunen
– Sani Huttunen, Commented Jun 8, 2018 at 23:30

JayV · Accepted Answer · 2018-06-08 23:33:50Z

3

Change to use Parameters, it will save you a lot of trouble.

SqlCommand cmd = new SqlCommand("UPDATE dbo.Status SET Status = @status WHERE ActivateMember = @activateMember",mydatabase.cn);
cmd.Parameters.AddWithValue("status", "<span class=\"label label-success\">Success</span>");
cmd.Parameters.AddWithValue("activateMember", i);

answered Jun 8, 2018 at 23:33

JayV

3,2712 gold badges11 silver badges16 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

CedeeCQ Over a year ago

Thank you very much! I'm sorry as I'm still new in coding.

JayV Over a year ago

@CedeeCQ If this answer works for you, don't forget to Accept it as the answer

Camilo Terevinto Over a year ago

@JayV Mandatory read: blogs.msmvps.com/jcoehoorn/blog/2014/05/12/…

Richardissimo Over a year ago

And it's also worth noting that SqlCommand is IDisposable, so should be in a using block. And unless I'm mistaken, the first parameter to AddWithValue is the name of the parameter, so it should start with an @ (example); but agree it's better not to use AddWithValue anyway, as mentioned above.

JayV Over a year ago

@Richardissimo Totally agree with the using block, always a good idea to use a using block if you can. For the Parameter Name though, when adding the parameter it's not necessary to add the '@' prefix. That is only necessary for the parameter name in the Sql statement (or : for Oracle statements)

Collectives™ on Stack Overflow

SQL command for update in C#

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related