Question

 static public void updateSelectedCaravan(string make, string model, string birth, string year, string Int, string ext, string width, string Unladen, string mtplm, string warranty, string freeText, string price, string location, string Tel, string Email, int makeID, string description)
{
    SqlConnection conn = new SqlConnection(ConnectionString);
    conn.Open();
    SqlCommand updateNews = new SqlCommand("Update [productDetail] SET [make] =@make , [model] = @model , [Berth] = @birth , [Year] =  @year , [InternalLength] = @Int , [ExternalLength] = @ext, [Width] = @width , [UnladenWeight] = @Unladen , [MTPLM] = @mtplm , [Warranty] = @warranty , [FreeTextDetails] = @freeText , [Price] = @price , [Location] = @location , [Tel] = @Tel , [Email] = @Email , [description] = @description where [makeID] = @makeID", conn);
    updateNews.Parameters.AddWithValue("@make", make);
    updateNews.Parameters.AddWithValue("@model", model);
    updateNews.Parameters.AddWithValue("@birth", birth );
    updateNews.Parameters.AddWithValue("@year", year);
    updateNews.Parameters.AddWithValue("@Int", Int);
    updateNews.Parameters.AddWithValue("@ext", ext);
    updateNews.Parameters.AddWithValue("@width", width);
    updateNews.Parameters.AddWithValue("@Unladen", Unladen);
    updateNews.Parameters.AddWithValue("@mtplm", mtplm);
    updateNews.Parameters.AddWithValue("@warranty",warranty);
    updateNews.Parameters.AddWithValue("@freeText", freeText);
    updateNews.Parameters.AddWithValue("@price", price);
    updateNews.Parameters.AddWithValue("@location", location);
    updateNews.Parameters.AddWithValue("@Tel", Tel);
    updateNews.Parameters.AddWithValue("@Email",Email );
    updateNews.Parameters.AddWithValue("@description",description );
    updateNews.Parameters.AddWithValue("@makeID", makeID);
    updateNews.ExecuteNonQuery();
    conn.Close();
}

The above query doesnt works works it gives an error Incorrect syntax near ‘8’, It was working fine before but I dont know for what reason it has stopped working , i have debugged d query and its passing all the required values.

Answer 1

Stop creating your own SQL queries. It’s vulnerable to SQL Injection attacks. Use parameterized expressions instead, and you won’t have to deal with these parameter errors anymore.

 SqlCommand cmd = new SqlCommand("UPDATE productDetail SET make = @make WHERE id = @id");
 cmd.Parameters.AddWithValue("@make", "someValue");
 cmd.Parameters.AddWithValue("@id", 1234);

 // execute