Question

If you please help me out i have an error in my code that i can not understand it.

the error is:

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: Incorrect syntax near ‘Login’.

and my code:

 public static void ChangePassword(string login, string password)
    {
        var sqlCon = new SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString);
        string query = @"update Organizer set Password ="+ password + "where Login=" + login + "";
        SqlCommand cmd = new SqlCommand(query, sqlCon);
        cmd.CommandType = CommandType.Text;
        try
        {
            sqlCon.Open();
            cmd.ExecuteNonQuery();
            sqlCon.Close();
        }
        catch (Exception ee) { throw ee; }
    }

Answer 1

• We’ve seen enough sql injection attacks, we don’t need another one, please fix your code and use parameters.
• Use using blocks to avoid leaking connections.
• Install an exception handler like ELMAH.

• Don’t save passwords in the database

  using (var sqlCon = new SqlConnection(...))
  {
      string query = @"update Organizer set Password =@password where Login=@login";
      SqlCommand cmd = new SqlCommand(query, sqlCon);
      cmd.CommandType = CommandType.Text;
      cmd.Parameters.Add("@password", SqlDbType.VarChar, 8000);
      cmd.Parameters["@password"].Value = password;  
      cmd.Parameters.Add("@login", SqlDbType.VarChar, 8000);
      cmd.Parameters["@login"].Value = login;  
  
      sqlCon.Open();
      cmd.ExecuteNonQuery();
      sqlCon.Close();
  

  }