How to update database records within a user input range?

Question

I am trying to update database records over a range in Access using SQL and C#. Using an UPDATE query keeps giving me an error

Syntax error (missing operator) in query expression

All of the query criteria is from user input. I have tried a number of sources to find an answer but I believe my SQL statement is correct. Below is the method that is performing the task that I need.

private void btnUpdate_Click(object sender, EventArgs e)
{
        int teamYear = Convert.ToInt32(this.textBoxBegYear.Text);
        int endYear = Convert.ToInt32(this.textBoxEndYear.Text);
        string teamName = this.textBoxTeamName.Text;
        string league = this.textBoxLeague.Text;
        string conference = this.textBoxConf.Text;
        string division = this.textBoxDivision.Text;

        try
        {
            dbConn = new OleDbConnection();
            dbConn.ConnectionString = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=" 
               + ch + openFileDialog1.FileName + ch;
            dbConn.Open();

            sql = "UPDATE " + this.comboBox1.SelectedItem.ToString() 
               + " SET LeagueName = @leagueName, ConferenceName = @conferenceName, 
               DivisionName = @divisionName WHERE TeamName = " + this.textBoxTeamName.Text 
               + " AND TeamYear BETWEEN " + this.textBoxBegYear.Text 
               + " AND " + this.textBoxEndYear.Text;

            dbCmd = new OleDbCommand(sql, dbConn);

            for (int i = teamYear; i <= endYear; i++)
            {
                dbCmd.Parameters.AddWithValue("@leagueName", league);
                dbCmd.Parameters.AddWithValue("@conferenceName", conference);
                dbCmd.Parameters.AddWithValue("@divisionName", division);
                dbCmd.ExecuteNonQuery();
            }
            dbCmd.Connection.Close();
            dbConn.Close();
        }
        catch (Exception err)
        {
            MessageBox.Show("Error: " + err.Message.ToString());
        }
}

The exception comes from the second half of the SQL statement after the WHERE clause asking for a missing operator.

Can anyone happen to see what I may be missing? Any help would be appreciated.

Answer 1

You might be missing single quotes ' ...

TeamName = '" + this.textBoxTeamName.Text + "'

Also, I'm assuming this is just a project you're playing around with and nothing that will be available online? Reason I ask is that the SQL query is vulnerable to SQL injection attacks .

Answer 2

You need to escape the text from the user input with single quotes.

WHERE TeamName = '" + this.textBoxTeamName.Text 
               + "' AND TeamYear BETWEEN " + this.textBoxBegYear.Text 
               + " AND " + this.textBoxEndYear.Text;

(Notice the single quotes).

Please do not use the code you posted. Please read up on SQL Injection attacks and why your code is very unsafe and replace it with some properly cleaned input handling.

Answer 3

Why don't you replace the code in the "try" block to this:

        dbConn = new OleDbConnection();
        dbConn.ConnectionString = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=" 
           + ch + openFileDialog1.FileName + ch;
        dbConn.Open();

        sql = "UPDATE " + this.comboBox1.SelectedItem.ToString() 
           + " SET LeagueName = @leagueName, ConferenceName = @conferenceName, 
           DivisionName = @divisionName WHERE TeamName = @teamName AND TeamYear BETWEEN @begYear AND @endYear";

        dbCmd = new OleDbCommand(sql, dbConn);

        for (int i = teamYear; i <= endYear; i++)
        {
            dbCmd.Parameters.AddWithValue("@leagueName", league);
            dbCmd.Parameters.AddWithValue("@conferenceName", conference);
            dbCmd.Parameters.AddWithValue("@divisionName", division);
            dbCmd.Parameters.AddWithValue("@teamName", this.textBoxTeamName.Text);
            dbCmd.Parameters.AddWithValue("@begYear", int.Parse(this.textBoxBegYear.Text));
            dbCmd.Parameters.AddWithValue("@endYear", int.Parse(this.textBoxBegYear.Text));
            dbCmd.ExecuteNonQuery();
        }
        dbCmd.Connection.Close();
        dbConn.Close();

Therefore, you have better idea what the SQL query looks like, and you parameterize users' input to improve security (prevent any sql injection).

To troubleshoot your issue, you may need to debug into this piece of code and see what's the SQL query is, and try to execute it from your SQL client tool (such as Sql management studio), you will have better idea what goes wrong.

Hope this helps. Henry Liang