Question

I have demonstrate following SQL between SQL and VS 2005:

update expbill set convrate=null
where transID=2
and companyID=114

The above T-SQL is working fine on SQL Server and updates the rows as NULL, but the same transaction is not working in VS 2005, using this SQL query:

string update_exp = " update expbill set convrate = " + null + "" +
                " where companyID = '" + label1.Text + "'" + 
                " and invno = '" + textBox1.Text + "'";
SqlCommand updated_cmd  = new SqlCommand(update_exp , con);
updated_cmd.ExecuteNonQuery();

The above SQL query throws an error

Incorrect syntax near the key words
“where”

I want to know that if the same SQL statement works in SQL but not in Visual Studio. Is there any difference of NULL function between SQL and VS 2005??

Answer 1

For the record:

string update_exp = @"
update expbill set convrate=@rate
where companyID=@cid
and invno=@iid";
SqlCommand updated_cmd  = new SqlCommand(update_exp , connection);
updated_cmd.Parameters.AddWithValue("rate", DBNull.Value);
updated_cmd.Parameters.AddWithValue("cid", label1.Text);
updated_cmd.Parameters.AddWithValue("iid", textBox1.Text);
updated_cmd.ExecuteNonQuery();

This will keep you safe. DO NOT CONCATENATE TEXT TO MAKE SQL. If that is typical of your coding style, I need you to realise that your code is dangerously exposed and can be abused and broken accidentally or maliciously. Pain. Lots of pain.