How can I update/delete data on my table in C# using OOP?

Question

I'm done with adding of data on my table and it works fine. I'm also done coding for update and delete function on my Class, but it's not updating the table. No errors found on my program.

Here's my code:

public void StudentUpdate(string id, string lastname, string firstname, string middlename, string suffix, string age, string gender, string paddress, DateTime birthday)
{
    result.Query = "Update tbl_student set lastname = '" + lastname + "', firstname = '" + firstname + "', middlename = '" + middlename + "', suffix = '" + suffix + "', age = '" + age + "', gender = '" + gender + "', pmt_address = '" + paddress + "', birthday = to_date('" + String.Format("{0:MM/dd/yyyy}", birthday.ToShortDateString()) + "','mm/dd/yyyy') where std_id = '" + id + "'";
    result.Transaction = true;
    result.ExecuteNonQuery();
    StudentCommit();
    result.Close();
}

public void StudentDelete(string id)
{
    result.Query = "Delete from tbl_student where std_id = '" + id + "'";
    result.ExecuteNonQuery();
    StudentCommit();
    result.Close();
}

public void StudentCommit()
{
    if (!result.Commit())
    {
        result.Rollback();
    }
}

Additionally, I have created a user login with account creation where my code in table (update/delete function) are working good. The only difference is that, I have three strings on my login table while in my student table I have many strings plus one datetime.

Answer 1

Most likely the select part of your update statement isn't locating any records: http://weblogs.asp.net/stevewellens/why-sql-updates-fail-three-reasons

And, as others pointed out, building strings like you are doing makes the code vulnerable to SQL injection. If it's an internal application or homework, it's not a big deal, otherwise you should be using parametrized queries .

Answer 2

i think because of this age = '" + age + "'

it should be age="+age+",

you need to erase the quote

because it is integer

and also in this code where std_id = '" + id + "'"

it should be where std_id = " + id;

i think the id is also int but you are putting it inside the quote, because of the typo error in sql, the c# doesn't know what the error is, so if you want to test your code, do it in sql so that you will see what the error(s).