sql语法错误发生？

Question

 string query = "update library_database.members set name='" + txtname.Text + "', Adresss='" + richtxtadress.Text + "',";
 query = query + "Status='" + cmbstatus.SelectedText + "',Type='" + cmbtype.SelectedText + "',";
 query = query + "Date_expiry='" + dateofexpiry.Value.ToString("yyyy-MM-dd") + "',@IMG";
 query=query+"' where id='";
 query = query + txtid.Text + "'";
 cmd = new MySqlCommand(query, con);
 cmd.Parameters.Add(new MySqlParameter("@IMG", imgbt));

The exception occur SQL Santax error at line 1 near @IMG. Please help how can I solve it?

Answer 1

Looks like you forget to column name when you update your @IMG value.

It should be something like;

query = ... "ColumnName = @IMG" + ...

But please

ALWAYS use parameterized queries . This kind of string concatenations are open for SQL Injection attacks.

Next time, when you get this kind of sql syntax error, first thing you should try is to run your query in your database manager. Then you can easily see what is wrong with your query and how you can fix it.