Question

I have created asp.net WebService. I want to update user’s info after validating him , means if new UserName entered by him is not already exist than only he can update new UserName otherwise not .

The problem is that it validates the user successfully but when i am trying to specify new UserName which is not exist than it gives me an error like ;

 Request format is unrecognized for URL unexpectedly ending in '/UpdateUserInfo'. 

Following is my code :

 public int UpdateUserInfo(string oldusername, string newusername, string mailid, string password)
    {
        string validateUser = "Select UserName from tbl_UserInfo where UserName='" + newusername + "' ";
        con = new MySqlConnection(conString);
        con.Open();
        MySqlCommand cmd1 = new MySqlCommand(validateUser, con);
        string User = cmd1.ExecuteScalar().ToString();
        con.Close();
        if (User == newusername)
        {
            return 0;
        }
        else 
        {
            string updateUser = "Update tbl_UserInfo SET UserName='" + newusername + "',Password='" + password + "',Email_ID='" + mailid + "' where UserName='" + oldusername + "' ";
            con = new MySqlConnection(conString);
            con.Open();
            MySqlCommand cmd = new MySqlCommand(updateUser, con);
            int success = cmd.ExecuteNonQuery();
            con.Close();

            if (success > 0)
            {
                return success;
            }
            else
                return 0;
        }
    }

NOTE : I want result as ;

         IF my UserName is A and when i update that UserName with same name 
           i.e A than it should not be updated but when i give another name as B 
             than it should be updated by B i.e now UserName A becomes the B

what can be problem ?

Please give solution.

Thanks..

Answer 1

Oh, please use parametrized queries. Ah, and dispose your IDisposable resources. You wil save yourself headaches, SQL injections, improperly formatted data, …

public int UpdateUserInfo(
    string oldusername, 
    string newusername, 
    string mailid, 
    string password
)
{
    using (var con = new MySqlConnection(conString))
    using (var cmd = con.CreateCommand())
    {
        con.Open();
        cmd.CommandText = "SELECT count(UserName) from tbl_UserInfo where UserName = @newusername";
        cmd.Parameters.AddWithValue("@newusername", newusername);

        var count = (long)cmd.ExecuteScalar();
        if (count < 1)
        {
            return 0;
        }
    }

    using (var con = new MySqlConnection(conString))
    using (var cmd = con.CreateCommand())
    {
        con.Open();
        cmd.CommandText = "UPDATE tbl_UserInfo SET UserName = @newusername, Password = @password, Email_ID = @mailid WHERE UserName = @oldusername";
        cmd.Parameters.AddWithValue("@newusername", newusername);
        cmd.Parameters.AddWithValue("@password", password);
        cmd.Parameters.AddWithValue("@mailid", mailid);
        cmd.Parameters.AddWithValue("@oldusername", oldusername);
        return cmd.ExecuteNonQuery();
    }
}

or you could also split those into separate methods:

public bool UsernameExists(string username)
{
    using (var con = new MySqlConnection(conString))
    using (var cmd = con.CreateCommand())
    {
        con.Open();
        cmd.CommandText = "SELECT count(UserName) from tbl_UserInfo where UserName = @newusername";
        cmd.Parameters.AddWithValue("@newusername", username);
        return (long)cmd.ExecuteScalar() > 0;
    }
}

public int Update(string oldusername, string newusername, string mailid, string password)
{
    using (var con = new MySqlConnection(conString))
    using (var cmd = con.CreateCommand())
    {
        con.Open();
        cmd.CommandText = "UPDATE tbl_UserInfo SET UserName = @newusername, Password = @password, Email_ID = @mailid WHERE UserName = @oldusername";
        cmd.Parameters.AddWithValue("@newusername", newusername);
        cmd.Parameters.AddWithValue("@password", password);
        cmd.Parameters.AddWithValue("@mailid", mailid);
        cmd.Parameters.AddWithValue("@oldusername", oldusername);
        return cmd.ExecuteNonQuery();
    }
}

public int UpdateUserInfo(string oldusername, string newusername, string mailid, string password)
{
    if (!UsernameExists(newusername))
    {
        return Update(oldusername, newusername, mailid, password);
    }
    return 0;
}