Swaminathan,

You shouldn'd build a query this way. Have your ever heard about SQL
Injection?
Use parameters instead of string manipulation.
Take a look at this link:

http://msdn.microsoft.com/en-us/library/system.data.oledb.oledbcommand.parameters.aspx

Here there's something about SQL Injection:

http://en.wikipedia.org/wiki/SQL_injection

2009/8/26 Processor Devil <[email protected]>

> string str = "update samp set name= '" + textBox2.Text + "', " +
> "place= '" + textBox3.Text + "'+" + "where id='" + textBox1.Text +
> "'";
> Yeah, it is the + as Cerebrus said :).
> Well, for next time try to use string.Format function instead of this quote
> storm, your example would look like
> string str = string.Format("update samp set name='{0}'; place='{1}' where
> id ='{2}'", textBox2.Text, textBox3.Text, textBox1.Text);
>
> 2009/8/25 Cerebrus <[email protected]>
>
>
>> + "'+" +
>>
>> The least you can do is check your update statement.
>>
>> On Aug 25, 7:17 pm, A M Swaminathan <[email protected]> wrote:
>> > hello  everybody,
>> >
>> > i am swami. i had developed a c#.net windows application with access
>> > database..
>> > in update operation i got error..  pls help me..
>> >
>> > The code is:
>> >
>> > OleDbConnection con = new OleDbConnection
>> > ("Provider=Microsoft.Jet.Oledb.4.0;Data Source=C:\\cictapp.mdb"
>> > OleDbDataAdapter od;
>> > DataSet ds;
>> > string str = "update samp set name= '" + textBox2.Text + "', " +
>> > "place= '" + textBox3.Text + "'+" + "where id='" + textBox1.Text +
>> > "'";
>> >                 od = new OleDbDataAdapter(str, con);
>> >                 ds = new DataSet();
>> >                 od.Fill(ds, "samp");
>> >                 label4.Text = "Record Updated";
>> >
>> > thanks in advance..
>> >
>> > regards
>> > swaminathan.
>>
>
>


-- 
Hamon Vitorino
MCP | MCTS(Web)
http://hamonvitorino.wordpress.com
http://zonadotnet.wordpress.com

Reply via email to