Syntax error in c# for database

Question

    public void EtiketVerisiKaydiGuncelle()
    {
        try
        {
            string sorgu = "UPDATE EtiketVerisi SET Tarih='" + this.TARIH + "', NetKG='" + this.NETKG + "', MalinCinsi='" + this.MAL + "', Musteri='" + this.MUSTERI + "', Renk='" + this.RENK + "', PartiNo='" + this.PARTINO + "', RollNo='" + this.ROLLNO + "', Barkod='" + this.BARKOD + "', WHERE Kimlik=" + this.Kimlik;

            if (bag.State == ConnectionState.Closed)
                bag.Open();
            komut.Connection = bag;
            komut.CommandText = sorgu;
            komut.ExecuteNonQuery();
            MessageBox.Show("Kayıt Güncellendi");
        }
        catch (Exception ex)
        {
            MessageBox.Show(ex.Message);
        }
    }

When I try to update information that is on database I take an error that is an syntax error in Update statement.

Answer 1

You have a comma before your WHERE clause

 "', WHERE Kimlik="

Also look into using parameters as your are leaving yourself open to SQL Injection attacks