SQL Update command error in ExecuteNonQuery


When i try to connect to my database to Edit a datatable in MVC. When I try to acces to my view i have an error when I execute my command. the error is:


System.Data.SqlClient.SqlException: 'incorrect syntax near ('. incorrect syntax near the kewword SET.


but i can not figure out my syntax errors. I am a Beginer so i am still learning the basis. It would be really grateful for any help. Thanks!. here is my code

private void UpdateDataBase(int EmailId, string userName, string title, string Email, string description) { var sqlstring = string.Format("UPDATE Email (Email, Description, UserName, Title) " + "SET ('{0}', '{1}', '{2}', '{3}')", Email, description, userName, title + "WHERE ID=" + EmailId); var myConnection = getconection(); SqlCommand myCommand = new SqlCommand(sqlstring, myConnection); myCommand.ExecuteNonQuery(); try { myConnection.Close(); } catch (Exception e) { Console.WriteLine(e.ToString()); } } public ActionResult Edit (int EmailId, string userName, string title, string Email, string description) { UpdateDataBase(EmailId, userName, title, Email, description); return View("EmailData"); } [HttpPost] public ActionResult Edit (ModelTemplateEmail EditEmailData) { if (ModelState.IsValid) { return RedirectToAction("EmailData"); }; return View(EditEmailData); }

There are a couple of problems with your code

<ol><li>The syntax for UPDATE is incorrect. It should be UPDATE SET columnName = value...</li> <li>Use parameterised queries, because at the moment your code is vulnerable to SQL injection</li> <li>Move myCommand.ExecuteNonQuery(); inside the try block to catch any exceptions</li> </ol>

Please see my update to your code:

var sqlstring = @"UPDATE Email SET Email = @email, Description = @description, UserName = @username, Title = @title WHERE ID = @id"); var myConnection = getconection(); SqlCommand myCommand = new SqlCommand(sqlstring, myConnection); // add parameters myCommand.Parameters.AddWithValue("@email", email); myCommand.Parameters.AddWithValue("@description", description); myCommand.Parameters.AddWithValue("@username", userName); myCommand.Parameters.AddWithValue("@title", title); myCommand.Parameters.AddWithValue("@id", emailId); try { // execute the command in the try block to catch any exceptions myCommand.ExecuteNonQuery(); myConnection.Close(); } catch (Exception e) { Console.WriteLine(e.ToString()); }

As mentioned in the comments, you should really perform the update in the HttpPost method and validate the values before calling UpdateDataBase().



  • Event_Handler of the Done button of a picker
  • GMT Offset with inputs: latitude and longitude
  • Qt WebView and WebChannel over WebSockets in QML
  • about iOS target version and SDK version
  • Linux could not find metis.h
  • Using MPI_Send/Recv to handle chunk of multi-dim array in Fortran 90
  • the IBM_JAVA error for running jobs in Hadoop 2.2.0
  • Tensorflow converging but bad predictions
  • How can I run an Illustrator javascript on all files in a directory?
  • iOS App crash issue `[UIWindow warpPoint:]`
  • Visual Studio MSB3721 error when compiling a __device__ function call from another file
  • Slick: How can I combine a SQL LIKE statement with a SQL IN statement
  • Unable to connect to AWS RDS through PDO
  • Auto send email based on the time and email address in database
  • Bison does not appear to recognize C string literals appropriately
  • how to add dashed border on highcharts “area” graph for every point
  • Spotify cocoalibspotify offline status set to 1 but all tracks stuck at waiting
  • ASP.NET MVC razor view, post to a different model from the original model binding?
  • ASP.NET MVC 2 actions for the same route?
  • How can i move Clearcase dyamic/snapshot views to another host (Linux)
  • C++ STL stack pop operation giving segmentation fault
  • Calculate time from document
  • DataTables move rows between tables
  • How to clear a browser cache in Protractor
  • iphone image to video issue in video speed
  • jQuery scrollTop if URL has hash
  • reshape/remould data frame to create normalized bar chart and pie chart
  • Google App Engine Datastore: Dealing with eventual consistency
  • Computing the discrete fourier transform of audio data with FFTW
  • Grails - How to implement a foreign key relationship not using an id column?
  • Accessing Arguments, Workflow Variables from custom activities
  • Spring Boot not autowiring @Repository
  • convert json to excel in java
  • ReferenceError: TextEncoder is not defined
  • ARKit code issue {unknown error -1=ffffffffffffffff error: Task failed with exit 1}