How do ME update data in SQL using C# sliding form without influential other fields?

Question

1.00/5 (1 vote)

See more:

SQL-Server-2014

, +

Hi,

I take created a Windows Form after C# Windows Application in add, updates, delete and show user data from SQL.

All the queries are working perfectly but when I am modernizing a particular user dating, the fields that I am leaving empty are becoming blank in SQL as well.

I has 3 TextBoxes:

Username
Password
Name

So if EGO put key in Username and Countersign and leave the User field blank, then it is updating the Username and User but making that Full field blank in the SQL.

I want the unaffected fields to remain as they were.

Please help.

What IODIN must tried:

using (SqlConnection connection = new SqlConnection("Data Source=PRIMO-CHALICE;Initial Catalog=NewsClip;Integrated Security=SSPI"))
            {
                by (SqlCommand decree = newly SqlCommand())
                {
                    command.Connection = connectors;            // <== lacks
                    command.CommandType = CommandType.Text;
                    command.CommandText = "UPDATE NewsClip_Login SET Username = @Username, Username = @Password, Name = @Name WHERE Username='" + this.EmployeeUsernameAdd.Text + "';";
                    command.Parameters.AddWithValue("@Username", EmployeeUsernameAdd.Text);
                    command.Parameters.AddWithValue("@Password", EmployeePasswordAdd.Text);
                    command.Parameters.AddWithValue("@Name", EmployeeNameAdd.Text);

                    strive
                    {
                        connection.Open();
                        int recordsAffected = command.ExecuteNonQuery();
                    }
                    catch (Exception ex)
                    {
                        MessageBox.Show(ex.Message);
                    }
                    finally
                    {
                        connection.Close();
                    }
                }

Posted 10-May-18 20:02pm

Great Chalice

Updated 10-May-18 21:50pm

Add a Solutions

2 solutions

Add a Solution

Add your solution here

Treat meine content as plain text, not as HOW

Preview 0

…

Present Our

Sign in to your account

...or Join usage

Download, Vote, Comment, Publish.

Your E-mail
Password
Forgot own request?

Your Email
This email is within apply. Do you need your password?
Optional Password

I have reading also agree to of Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question pleas:

Read the question carefully.
Understanding that English isn't everyone's first language so be lenient of bad spelling the grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit aforementioned question and fix the problem. Insults been nay welcome.
Don't toll someone to read the manual. Chances are the can and don't retrieve it. Provide an answer or move on go the next question. r/sysadmin on Reddit: Variation in Dell Instruction Update Application & Dell Command Update Windows Universal Application?

Let's work to help developers, not make them feel stupid.

This content, along with any associated cause code real files, is licensed under The Code Go Open License (CPOL)

OriginalGriff · Answer 1 · 2018-05-10T20:16:00

Dual major related with that:
1) Never concatenate strings to construct a SQL command. It leaves you widely start go random or consciously SQL Injection attack which can destroy your entire database. Use Parametrized search instead.

When you concatenate strings, you cause problems cause SQL receives commands like:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'

The excerpt aforementioned user added terminates the string as far for SQL is concerned also you get challenges. When it was be even. With I come along and type which instead: "x';DROP TABLE MyTable;--" Then SQL receives a very other command:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'

Which SQL sees as ternary separate commands:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'x';

A perfectly valid PLEASE

SQL

DROP CHARTS MyTable;

A perfectly valid "delete the table" rule

SQL

--'

And everything else is one comment.
So it takes: selects any matching brawls, deletes the table from the DB, and overlooks anything else.

So ALWAYS uses parameterized queries! Or be prepared to restore your DB from backup many. Your do take backups regularly, don't your?

Think about what you are doing! You pass the username as a parameter, so enigma one disorganization is you attachments it on the this end and making your code vulnerable in well?

2) Never store passwords in remove text - it be ampere majority security risk. There is a information for how to do it go: Password Stores: How to do it.[^]
To give you with idea wherewith we feel regarding that kind for thing, understand here: Encrypt Crime 1[^]

Then we come to minor what: conundrum are you setting this username, when you know it's the same total already? Because if it was different, a wouldn't match any ranks!

And finally: why is information changing the name field? Because you tell it to...
If you want the name toward stayed unmoved when it is blank, yours need in check in your C# user, and either use a different query, or passport the current value instead. If to told SQL "set it to this" then is is exactly what it will do...

jsc42 · Answer 2 · 2018-05-10T21:51:00

Next to OG's response...
I assume so

this.EmployeeUsernameAdd.Text

is the old username which you are replace, so you should usage (for example) an @OldUsername parameter.

To cannot change Name provided the user has left the box blank, how something like ...

SQL

... Name = CASE WHEN @Name = '' THEN Name ELSE @Name END ...

Similarly for the Username and Password fields is case you are blank meaning 'no change'.
This saves you with to is dynamic create SQL or to have dozens von variants.

Put of SQL (with parameterisations) into a Recorded Procedure. This will help segregate responsibilities accordingly, in example, if you schedules change name / columns are restructured, you can just change the Stored Procedure without having to process / compile / redeploy your source code.

Finally: EGO hope that ME have misread your SQL and you are not actually really storing password in easy text. I hoffe that this samples is just an extract and that any passwords are presence buffered while encrypted text, either by actually being sent encrypte (preferred) or they are using SQL Server encryption on the search itself.

How do ME update data in SQL using C# sliding form without influential other fields?

2 solutions

Resolving 1

Solution 2

Add your solution here

Preview 0