Question

I’m trying to update my database i.e. a MS Access file, I want to update my table by taking the values from the textboxes but I’m not able to write a proper query.

Can anyone please help me to write a proper update query?

string strconn4 = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=|DataDirectory|pay.accdb";

OleDbConnection sqlconn4 = new OleDbConnection(strconn4);
sqlconn4.Open();    
OleDbCommand ocmd = new OleDbCommand("UPDATE fees SET fname=" + Convert.ToString(textBox2.Text) + ",lname=" + Convert.ToString(textBox3.Text) + ",amtpayd=" + Convert.ToString(textBox4.Text) + ",amtleft=" + Convert.ToString(textBox5.Text) + ",disc=" + Convert.ToString(textBox6.Text) + ",pdate=" + Convert.ToString(dateTimePicker3.Text) + ",rdate=" + Convert.ToString(dateTimePicker1.Text) + ",WHERE memid=" + Convert.ToString(textBox1.Text), sqlconn4);

Answer 1

Your code is prone to SQL injection which is a very serious security problem!

You should use parameterized queries instead.

Some links on how build such queries including references and samples:

• http://msdn.microsoft.com/en-us/library/system.data.oledb.oledbcommand.aspx
• http://www.mikesdotnetting.com/Article/26/Parameter-Queries-in-ASP.NET-with-MS-Access
• https://stackoverflow.com/a/4589424/847363
• http://social.msdn.microsoft.com/Forums/en/accessdev/thread/33f3f6bc-03b2-4f64-84ca-cef65bbc0eee