Question

I’ve got an ASP.NET 4.0 C# web application that allows multiple users to update rows in the SQL Server DB at the same time. I’m trying to come up with a quick system that will stop USER1 from updating a row that USER2 updated since USER1’s last page refresh.

The problem I’m having is that my web application always updates the row, even when I think it shouldn’t. But when I manually run the query it only updates when I think it should.

This is my SQL query in C#:

SQLString = "update statuses set stat = '" + UpdaterDD.SelectedValue +
            "', tester = '" + Session["Username"].ToString() +
            "', timestamp_m = '" + DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss.fff") +
            "' where id IN (" + IDs + ") and timestamp_m < '" + PageLoadTime + "';";

And here’s a ‘real world’ example:

SQLString = "update statuses set stat = 'PASS', tester = 'tester007',
             timestamp_m = '2013-01-23 14:20:07.221' where id IN (122645) and
             timestamp_m < '2013-01-23 14:20:06.164';"

My idea was that this will only update if no other user has changed this row since the user last loaded the page. I have formatted PageLoadTime to the same formatting as my SQL Server DB, as you can see with DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss.fff"), but something still isn’t right.

Does anyone know why I get two different results? Is what I want to do even possible?

Answer 1

I really think the problem is that the page load time is not being set correctly, or is being set immediately before the DB call. For debugging, you may try hardcoding values into it that you know will allow or disallow the insert.

Here’s a parameterized version of what you have. I also am letting the DB server set the timestamp to its current time instead of passing a value. If your DB server and your Web server may not have their time of day in synch, then set it yourself.

Using parameterization, you don’t have to worry about whether the date/time format is correct or not. I don’t know what the DB types are of stat, tester, and timestamp_m so adding the parameter DB type may need adjusting.

string sql = "update statuses set stat = @stat, tester = @tester" +
        ", timestamp_m = getdate()" +
        " where id IN (" + IDs + ") and timestamp_m < @pageLoadTime";

SQLConnection conn = getMeASqlConnection();

SQLCommand cmd = new SQLCommand(sql, conn);

cmd.Parameters.Add("@stat", System.Data.SqlDbType.NVarChar).Value = UpdaterDD.SelectedValue;
cmd.Parameters.Add("@tester", System.Data.SqlDbType.NVarChar).Value = Session["Username"].ToString();
// Here, pageLoadTime is a DateTime object, not a string
cmd.Parameters.Add("@pageLoadTime", System.Data.SqlDbType.DateTime).Value = pageLoadTime;