what query to fire in Row updating event?

[hemantc87]

protected void GridView1_RowUpdating(object sender, GridViewUpdateEventArgs e)
        {
            conn.Open();
            int idx = e.RowIndex;
            GridViewRow row1 = GridView1.Rows[idx];
          //  string s = row1.Cells[0].Text;
            TextBox name = (TextBox)row1.Cells[1].Controls[0];
            TextBox course = (TextBox)row1.Cells[2].Controls[0];
            TextBox age = (TextBox)row1.Cells[3].Controls[0];
            TextBox sex = (TextBox)row1.Cells[4].Controls[0];
            TextBox dob = (TextBox)row1.Cells[5].Controls[0];
            TextBox address = (TextBox)row1.Cells[6].Controls[0];
            TextBox contctno = (TextBox)row1.Cells[7].Controls[0];
            TextBox mailid = (TextBox)row1.Cells[8].Controls[0];
            string qd = "update Student set Name='" + name.Text + "',Course='" + course.Text + "',Age=" + age.Text + ",Sex='" + sex.Text + "',DateofBirth='" + dob.Text + "',Address='" + address.Text + "',Contactno=" + contctno.Text + ",Email='" + mailid.Text + "' where Contactno=" + contctno.Text + "";
            SqlCommand cmd=new SqlCommand(qd,conn);
            cmd.ExecuteNonQuery();
 
            GridView1.EditIndex = -1;
            GridView1.DataBind();
            conn.Close();
            fillgv();
        }
 

the Contactno is my primary key here....whenever i try to update the number it doesn't get updated while all other values get easily updated..i know there is some problem with WHERE clause in my query but i cant figure out what to write instead of this??? and i know firing a sql query is not considered a good programming method so can anyone suggest any other method??

[CroCrew]

I for one don’t understand the question. Could you provide more detail? Are you getting an error?

Sorry,
CroCrew~

[Frinavale]

I recommend that you avoid dynamically creating your SQL command the way that you are. Using this method leaves you open to a SQL Injection Attack. These types of attacks are very serious and can be avoided.

In .NET you can use the SqlCommand.Parameters property to build your SQL commands. When you use parameters, anything supplied as a parameter is treated as Literal data.

If you do not use parameters and you simply concatenate a string together using the input provided by the user, the data is not treated as a Literal, meaning that when the SQL query is compiled into a command any SQL syntax entered by the user will also be compiled (letting them query your database).

It's a good idea to start using parameters now before you get into bad habits.

Check out this article on How to use a database in your program for examples on how to use Paremeters with the SqlCommand.

If you're interested in reading up on Sql Injection Attack, check out this article on Sql Inject Attack

Anyways, regarding your question...are you sure you're allowed to update a Primary Key?

-Frinny

[hemantc87]

@Frinavale
the primary key issue was solved and thank you for telling me about sql injection attack..Your articles on it were really helpful..i just wanted to know that the method i used now was correct or not??

SqlCommand cmb = new SqlCommand();
            cmb.Connection = conn;
            cmb.CommandType = CommandType.Text;
            cmb.CommandText="update Student set Name='" + name.Text + "',Course='" + course.Text + "',Age=" + age.Text + ",Sex='" + sex.Text + "',DateofBirth='" + dob.Text + "',Address='" + address.Text + "',Contactno=" + contctno.Text + ",Email='" + mailid.Text + "' where Contactno=" + contctno.Text + "";
cmb.ExecuteNonQuery();
 
 

if not correct what is the right way to to do it with parameters??

[Frinavale]

You can't really tell...
The ExecuteNonQuery method returns the number of rows affected...which you can check to make sure that at least one row was updated but you can't tell if the data was stored correctly without selecting from the table again to make sure.

-Frinny