Question

I’m writing some code updating database with a SQL statement that has some placeholders . But it doesn’t seem to update these placeholders.

I got the following error:

Cannot update '@columnName'; field not updateable

Here is the method:

    public void updateDoctorTableField(string columnName, string newValue, string vendorNumber) {
        sqlStatement = "update Doctor set @columnName = @newValue where `VENDOR #` = @vendorNumber;";
        try {
            _command = new OleDbCommand(sqlStatement, _connection);
            _command.Parameters.Add("@columnName", OleDbType.WChar).Value = columnName;
            _command.Parameters.Add("@newValue", OleDbType.WChar).Value = newValue;
            _command.Parameters.Add("@vendorNumber", OleDbType.WChar).Value = vendorNumber;

            _command.ExecuteNonQuery();
        } catch (Exception ex) {
            processExeption(ex);
        } finally {
            _connection.Close();
        }
    }

Answer 1

Not all parts of the query are parameterisable.

You can’t parametrise the name of the column. This needs to be specified explicitly in your query text.

If this is sent via user input you need to take care against SQL Injection. In fact in any event it would be best to check it against a whitelist of known valid column names.