Question

I have dropdownlist (id="myDDL").

I have the method (updateTable_byDDL) for update my sql table, the method work great when I put manual value in the SET="bla" ..

But when I write in the SET= '"+ myDDL.Text.ToString() + "', the column on the SQL update to empty.

The dropdownlist is binding from array that I put outside the page_load (in the class), and I am binding it on the page load:

    myDDL.DataSource = array;
    myDDL.DataBind();

In the aspx page I can see well the array values in the dropdownlist, but after I chose the item I want – and click on the button, the column turn to empty.

Where am I going wrong?

Answer 1

1. You should take myDDL.SelectedItem.Text
2. You should use parameters to avoid SQL injection

Check it out:

   YourUpdateCommand.CommandText = "UPDATE table SET column = @NewValue WHERE conditions";

   YourUpdateCommand.Parameters.Add("@NewValue", System.Data.SqlDbType.VarChar, 100); //or whatever

   YourUpdateCommand.Parameters["@NewValue"].Value = myDDL.SelectedItem.Text;

   YourUpdateCommand.ExecuteNonQuery();