passing multiple parameters to the query in C#

[Deepali Khalkar]

I have tried with the following parameterised query for select statement and is working fine. SqlCeConnection conn; SqlCeCommand comm; comm = new SqlCeCommand(); comm.Connection = conn; comm.CommandText = "select * from signuptbl where username =@uname"; SqlCeParameter para = new SqlCeParameter(); para.ParameterName = "@uname"; para.Value = textBox1 .Text ; comm.Parameters.Add(para); Now i want to write an update query which takes multiple parameters. I have thought of the following code. SqlCeConnection conn; SqlCeCommand comm; comm = new SqlCeCommand(); comm.Connection = conn; comm.CommandText = "update signuptbl set firstname=@fname,lastname=@lname,,psw=@psw1 where username =@uname"; SqlCeParameter para = new SqlCeParameter(); para.ParameterName = "@uname"; para.Value = textBox1 .Text ; comm.Parameters.Add(para); para.ParameterName = "@psw"; para.Value = textBox2 .Text ; comm.Parameters.Add(para); para.ParameterName = "@fname"; para.Value = textBox3 .Text ; comm.Parameters.Add(para); para.ParameterName = "@lname"; para.Value = textBox3 .Text ; comm.Parameters.Add(para); I have tried this code but the row was not updated. Is this a proper way? How to pass multiple parameters in a query? Can i get a sample code for the same. Thanks in advance.. :)

[N a v a n e e t h]

You have created only one parameter and overwriting it's properties each time. You need separate SqlCeParameter instances for each parameter.

comm.Parameters.AddWithValue("@uname",textBox1 .Text);
comm.Parameters.AddWithValue("@psw",textBox2 .Text);
...

AddWithValue[^] will create SqlCeParameter internally and add it to the Parameters collection. :)

Navaneeth How to use google | Ask smart questions

[Megidolaon]

An easy way is to only pass one string that is the full query. You simply construct it by using variables in C# to read the input and then adding it to the query string. You might have to add brackets and commas to the query string after the variables have been added.

[J4amieC]

Worst answer you could have given, you've just told the OP to take aa step backwards to dynamically-built sql queries rather than using parameters. You should read up on SQL Injection attacks.

[fly904]

In most of my code I pass the parameters as a variable to another function which would make the code look like this:

SqlCeParameter[] sqlParams = new SqlCeParameter[4];

sqlParams[0] = new SqlCeParameter("@uname", textbox1.Text);
...

comm.Parameters.AddRange(sqlParams);

hmmm pie