Have Geek Brain

Syntax error in update statement

the code:

string query1 = @"UPDATE global_mapping set escape_id = " + 
  dataGridView1.Rows[i].Cells[2].Value + ",function_id = " + 
  dataGridView1.Rows[i].Cells[3].Value + ",function_name = '" + 
  dataGridView1.Rows[i].Cells[4].Value + "',parameter_name = '" + 
  dataGridView1.Rows[i].Cells[5].Value + "',parameter_validity = '" + 
  dataGridView1.Rows[i].Cells[6].Value + "',statusparameter_id = " + 
  dataGridView1.Rows[i].Cells[7].Value + ",acb_datatype = '" + 
  dataGridView1.Rows[i].Cells[8].Value + "',data_type_id = " + 
  dataGridView1.Rows[i].Cells[9].Value + ",bit_size = " + 
  dataGridView1.Rows[i].Cells[10].Value + ",validity_status ='" + 
  dataGridView1.Rows[i].Cells[11].Value + "',validity_func = '" + 
  dataGridView1.Rows[i].Cells[12].Value + "'WHERE global_mapping.parameter_id =" + 
  dataGridView1.Rows[i].Cells[1].Value + "";
OleDbCommand cmd1 = new OleDbCommand(query1, conn);
cmd1.ExecuteNonQuery();

end of code:

When I execute the above code, I get the "Syntax error in update statement" error. Can someone please tell me how to resolve this?

0


a source to share


6 answers


It looks like you need to add a space before the WHERE clause.

Hope it helps,



Bill

+2


a source


Wow. Can we say ... SQL Injection?



Try using parameters. Not only will you protect yourself, your SQL will become MUCH more readable.

+1


a source


Never use string concatenation to build SQL queries. Use SQL parameters.

+1


a source


Clap! Give the final value to query1 and try to format it so we can better understand it. My guess is missing or whatever.

0


a source


I would say that you are missing some quotes, but your code is so piggy I can't tell. If you don't fix your code, then at least give us a request dump1 so we can read your actual request.

And use parameters or stored procedures just like the previous answers. All it takes is one of your variables, which could be overwritten by something nasty and your server will be wide open for anyone to delete your tables or worse.

Even if it is a local "safe" database, you must now wean your bad habits.

0


a source


Put Console.WriteLine(query1)

upOleDbCommand cmd1 = new OleDbCommand(query1, conn);

See the value query1

printed in the console window.
Is the SQL statement being asked ok? Probably not - you should now be able to find a field that is not numeric and blank in the grid.

And, use the parameters as others have said.

-1


a source






More articles:


All Articles