ERROR ON UPDATE QUERY

Sadaf Naeem

the code in my application is: OleDbCommand com = new OleDbCommand(); com.Connection = con; com.CommandText = "UPDATE tblUsers SET Password=? WHERE UserName=?"; com.Parameters.Add("UserName", OleDbType.WChar); com.Parameters.Add("Password", OleDbType.WChar); com.Parameters["UserName"].Value = this.UserName; com.Parameters["Password"].Value = this.txtPassword1.Text; ------------------------------------------------------------------------------- When I run the application , it gives the syntax error in update query. I am unable to find where I am going wrong Kindly help me!

Sadaf

Khawar Abbas1

Why not you try this: com.CommandText = "UPDATE tblUsers SET Password='" + this.UserName.Text + "' WHERE UserName='" + this.txtPassword1.Text + "'"

Do good and have good.

pmarfleet

Silent Eagle wrote:

com.CommandText = "UPDATE tblUsers SET Password='" + this.UserName.Text + "' WHERE UserName='" + this.txtPassword1.Text + "'"

Shouldn't that be: com.CommandText = "UPDATE tblUsers SET Password='" + this.txtPassword1.Text + "' WHERE UserName='" + this.UserName.Text + "'"

Paul Marfleet "No, his mind is not for rent To any God or government" Tom Sawyer - Rush

Khawar Abbas1

Thanks, Yes you are right. It is written mistakenly but i think it conveys the concept.

Do good and have good.

Sadaf Naeem

Thanks all for ur kind help but its still giving the same error!

Sadaf

sumit7034

try this code OleDbCommand com = new OleDbCommand(); com.Connection = con; com.CommandText = "UPDATE tblUsers SET Password=? WHERE UserName=?"; com.Parameters.Add("UserName", OleDbType.WChar); com.Parameters.Add("Password", OleDbType.WChar); com.Parameters["UserName"].Value = this.UserName.Text;//Error was here com.Parameters["Password"].Value = this.txtPassword1.Text;

Blue_Boy

try this com.CommandText = "UPDATE tblUsers SET [Password]='" + this.txtPassword1.Text + "' WHERE [UserName]='" + this.UserName.Text + "'"

I Love SQL

pmarfleet

There are two major flaws in your code: 1. Generating SQL statements on the fly is generally considered bad practice. It leaves you exposed to SQL injection attacks. Instead, consider writing a stored procedure to perform your update and call it from your .NET code. 2. You appear to be storing your user's passwords in clear text. This is very insecure. You should consider encrypting your password using a 1-way salted hash algorithm.

Paul Marfleet "No, his mind is not for rent To any God or government" Tom Sawyer - Rush

Pete OHanlon

No. Don't do this. Haven't you heard of SQL Injection Attacks? Have a read through the many wonderful articles before you find out why this is wrong, oh so wrong.

Deja View - the feeling that you've seen this post before.

My blog | My articles

Blue_Boy

Sure I have attention about SQL injection attacks...

I Love SQL

Pete OHanlon

If you are aware about SQL Injection Attacks, then why do you recommend something that is wide open to such an attack? It's your responsibility when posting an answer to give good advice and not to post something that is such blatant bad practice.

Deja View - the feeling that you've seen this post before.

My blog | My articles

Blue_Boy

but it's not my responsibility to teach others about SQL injection all of programmers must know about SQL injections... Why you not gonna explain him about SQL injections?

I Love SQL