''.C＃附近的语法不正确

Question

I get error

INCORRECT SYNTAX NEAR ' '

Here is my code:

SqlConnection conn = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Users\Mr\Documents\Student.mdf;Integrated Security=True;Connect Timeout=30;User Instance=True");
SqlCommand cmd = new SqlCommand();
cmd.Parameters.Clear();
cmd.Connection=conn;
cmd.CommandText = "update student set Name='" + textBox1.Text + "',Family='" + textBox2.Text + "',Fathername='" + textBox3.Text + "',ShenasName='" + textBox4.Text + "',CodeMeli'" + textBox5.Text + "',Tavalod'" + maskedTextBox1.Text + "',Address'" + richTextBox1.Text + "',Madraak'" + textBox7.Text + "',Shahriye'" + textBox8.Text + "',Mobile'" + textBox6.Text + "'where Name=" + textBox1.Text;
conn.Open();
cmd.ExecuteNonQuery();
conn.Close();
MessageBox.Show("jj");

My database is SQL Server Express.

Answer 1

SqlConnection conn = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Users\Mr\Documents\Student.mdf;Integrated Security=True;Connect Timeout=30;User Instance=True");

conn.Open();

SqlCommand cmd = new SqlCommand();
cmd.Parameters.Clear();
cmd.Connection=conn;

cmd.CommandText = @"
UPDATE 
   Student 
SET 
   Name=@Name, Family=@Family, Fathername=@Fathername, ShenasName=@ShenasName, CodeMeli = @CodeMeli,
   Tavalod=@Tavalod, Address=@Address, Madraak=@Madraak, Shahriye=@Madraak, Mobile=@Mobile
WHERE
   Name=@Name";

cmd.Parameters.AddWithValue("@Name", textBox1.Text);
cmd.Parameters.AddWithValue("@Family", textBox2.Text);
cmd.Parameters.AddWithValue("@Fathername", textBox3.Text);
cmd.Parameters.AddWithValue("@ShenasName", textBox4.Text);
cmd.Parameters.AddWithValue("@CodeMeli", textBox5.Text);
cmd.Parameters.AddWithValue("@Tavalod", maskedTextBox1.Text);
cmd.Parameters.AddWithValue("@Address", richTextBox1.Text);
cmd.Parameters.AddWithValue("@Madraak", textBox7.Text);
cmd.Parameters.AddWithValue("@Shahriye", textBox8.Text);
cmd.Parameters.AddWithValue("@Mobile", textBox6.Text);
cmd.ExecuteNonQuery();

conn.Close();               

MessageBox.Show("jj");

Here is the code. First Format your query properly, your query was unreadable. Second use Command parameters to avoid SQL Injection. You can read in Wikipedia about sql injection. Third write "nice" textBox ID, which have some meaning.

Answer 2

There are some errors:

• missing equals after: CodeMeli= , Tavalod= , Address= , Madraak= , Shahriye= , Mobile=
• missing ending of the sql statement + "'"

This will work:

SqlConnection conn = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Users\Mr\Documents\Student.mdf;Integrated Security=True;Connect Timeout=30;User Instance=True");
SqlCommand cmd = new SqlCommand();
cmd.Parameters.Clear();
cmd.Connection = conn;
cmd.CommandText = "update student set Name='" + textBox1.Text + "',Family='" + textBox2.Text + "',Fathername='" + textBox3.Text + "',ShenasName='" + textBox4.Text + "',CodeMeli='" + textBox5.Text + "',Tavalod='" + maskedTextBox1.Text + "',Address='" + richTextBox1.Text + "',Madraak='" + textBox7.Text + "',Shahriye='" + textBox8.Text + "',Mobile='" + textBox6.Text + "'where Name='" + textBox1.Text + "'";
conn.Open();
cmd.ExecuteNonQuery();
conn.Close();
MessageBox.Show("jj");

In any case, I recommend you the use of Parameters. Why?

SqlConnection conn = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Users\Mr\Documents\Student.mdf;Integrated Security=True;Connect Timeout=30;User Instance=True");
SqlCommand cmd= new SqlCommand();
cmd.Parameters.Clear();
cmd.Connection = conn;
cmd.CommandText = @"UPDATE Student SET Name=@Name, Family=@Family, Fathername=@Fathername, ShenasName=@ShenasName, CodeMeli = @CodeMeli,Tavalod=@Tavalod, Address=@Address, Madraak=@Madraak, Shahriye=@Madraak, Mobile=@Mobile WHERE Name=@Name";

cmd.Parameters.AddWithValue("@Name", textBox1.Text);
cmd.Parameters.AddWithValue("@Family", textBox2.Text);
cmd.Parameters.AddWithValue("@Fathername", textBox3.Text);
cmd.Parameters.AddWithValue("@ShenasName", textBox4.Text);
cmd.Parameters.AddWithValue("@CodeMeli", textBox5.Text);
cmd.Parameters.AddWithValue("@Tavalod", maskedTextBox1.Text);
cmd.Parameters.AddWithValue("@Address", richTextBox1.Text);
cmd.Parameters.AddWithValue("@Madraak", textBox7.Text);
cmd.Parameters.AddWithValue("@Shahriye", textBox8.Text);
cmd.Parameters.AddWithValue("@Mobile", textBox6.Text);
conn.Open();
cmd.ExecuteNonQuery();
conn.Close();
MessageBox.Show("jj");

using table2 instead of student

SqlConnection conn = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Users\Mr\Documents\Student.mdf;Integrated Security=True;Connect Timeout=30;User Instance=True");
SqlCommand cmd = new SqlCommand();
cmd.Parameters.Clear();
cmd.Connection = conn;
cmd.CommandText = "update table2 set Name='" + textBox1.Text + "',Family='" + textBox2.Text + "',Fathername='" + textBox3.Text + "',ShenasName='" + textBox4.Text + "',CodeMeli='" + textBox5.Text + "',Tavalod='" + maskedTextBox1.Text + "',Address='" + richTextBox1.Text + "',Madraak='" + textBox7.Text + "',Shahriye='" + textBox8.Text + "',Mobile='" + textBox6.Text + "'where Name='" + textBox1.Text + "'";
conn.Open();
cmd.ExecuteNonQuery();
conn.Close();
MessageBox.Show("jj");

OR

SqlConnection conn = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Users\Mr\Documents\Student.mdf;Integrated Security=True;Connect Timeout=30;User Instance=True");
SqlCommand cmd= new SqlCommand();
cmd.Parameters.Clear();
cmd.Connection = conn;
cmd.CommandText = @"UPDATE table2 SET Name=@Name, Family=@Family, Fathername=@Fathername, ShenasName=@ShenasName, CodeMeli = @CodeMeli,Tavalod=@Tavalod, Address=@Address, Madraak=@Madraak, Shahriye=@Madraak, Mobile=@Mobile WHERE Name=@Name";

cmd.Parameters.AddWithValue("@Name", textBox1.Text);
cmd.Parameters.AddWithValue("@Family", textBox2.Text);
cmd.Parameters.AddWithValue("@Fathername", textBox3.Text);
cmd.Parameters.AddWithValue("@ShenasName", textBox4.Text);
cmd.Parameters.AddWithValue("@CodeMeli", textBox5.Text);
cmd.Parameters.AddWithValue("@Tavalod", maskedTextBox1.Text);
cmd.Parameters.AddWithValue("@Address", richTextBox1.Text);
cmd.Parameters.AddWithValue("@Madraak", textBox7.Text);
cmd.Parameters.AddWithValue("@Shahriye", textBox8.Text);
cmd.Parameters.AddWithValue("@Mobile", textBox6.Text);
conn.Open();
cmd.ExecuteNonQuery();
conn.Close();
MessageBox.Show("jj");

Answer 3

Look at your CommandText . There are some Parameters without ( = ) Format like this :

cmd.CommandText = "update student set Name='" + textBox1.Text + "',
                                    Family='" + textBox2.Text + "',
                                    Fathername='" + textBox3.Text + "',
                                    ShenasName='" + textBox4.Text + "',
                                    CodeMeli='" + textBox5.Text + "',
                                    Tavalod='" + maskedTextBox1.Text + "',
                                    Address='" + richTextBox1.Text + "',
                                    Madraak='" + textBox7.Text + "',
                                    Shahriye='" + textBox8.Text + "',
                                    Mobile='" + textBox6.Text + "'
                   where Name=" + textBox1.Text;

Answer 4

Incorrect syntax ')'

 private void btnInsert_Click(object sender, EventArgs e) {
     for (int i = 0; i < dataGridView1.Rows.Count; i++)
        {
            SqlConnection con = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\Database1.mdf;Integrated Security=True;User Instance=True");
            SqlCommand cmd = new SqlCommand("INSERT INTO Customers(Id,Name,Country,) values (@Id,@Name,@Country)",con);
            con.Open();
            cmd.Parameters.AddWithValue("@Id",dataGridView1.Rows[i].Cells[0].Value);
            cmd.Parameters.AddWithValue("@Name",dataGridView1.Rows[i].Cells[1].Value);
            cmd.Parameters.AddWithValue("@Country",dataGridView1.Rows[i].Cells[2].Value);

            cmd.ExecuteNonQuery();
            con.Close();
        }
      MessageBox.Show("Added successfully!");
 }