Question

//how to use the N character to make my program update Arabic Fields (first name =”الاسم الاول”)…
I mean

UPDATE  students SET first_name = N'الاسم' , last_name = N'الاسم الاخير' , father_name = N'الاسم الاخير' , mother_name = '', birth_date = '1/1/1990 12:00:00 AM' , education_level = '' , address = '' , notes = '' WHERE student_id = 33

//this command in MSSQL-Server but I am trying to use the UPDATE command in my C# program

 public string student(int id, string first_name, string last_name, string father_name, string mother_name, DateTime birth_date, string education_level, string address, 
         int[] phone_numbers, int[] old_phone_numbers, string notes)
    {
        SqlConnection SQLconnection = new SqlConnection(connectionString);
        SqlCommand command = SQLconnection.CreateCommand();
        SQLconnection.Open();
        command.CommandText = "UPDATE  students SET " +
        "first_name = " + "'" + first_name + "'" + " , last_name = " + "'" + last_name + "'" +
         " , father_name = " + "'" + father_name + "'" + " , mother_name = " + 
        "'" + mother_name + "'" + ", birth_date = " + "'" + birth_date + "'" +
        " , education_level = " + "'" + education_level + "'"  +
        " , address = " + "'" + address + "'" + " , notes = " + "'" + notes + "'" +
        " WHERE student_id = " + id ;
        command.ExecuteNonQuery();
        SQLconnection.Close();

//is there a better and clear way better than these syntax ?

Answer 1

The best method would be to use Parameters. Like this:

command.CommandText = @"UPDATE  students SET 
first_name = @first_name, 
last_name = @last_name,
//... and so on...
WHERE student_id = @id";
command.Parameters.AddWithValue("@first_name", first_name);
command.Parameters.AddWithValue("@last_name", last_name);
//... and so no...
command.Parameters.AddWithValue("@id", id);