Update with column name by parameter

Question

How can I pass a columns name by parameter,

follow an example

DataTable dt = new DataTable();

// Here I fill my datatable

for (int i = 0; i < dt.Rows.Count; i++)
{
     for (int j = 0; j < dt.Columns.Count; j++)
     {
       string columnsname = dt.Rows[i][dt.columns[j].toString()].toString();
       SqlCommand comando = new SqlCommand();
       comando.commandText = "UPDATE Sales.Store SET @columnname = @demographics where id =   @id";
       comando.Parameters.Add(new SqlParameter("@columnname", columname));
       comando.Parameters.Add(new SqlParameter("@dados2", dados2));
       comando.ExecuteNonQuery();
       comando.Clear();
       comando.Dispose()
    } 
}

This doesn't work, but I have 88 columns, and I need update all data in every 88 columns in each row.

Answer 1

You cannot parameterize column names.

To do what you want you will need to resort to dynamic SQL .

Answer 2

I have figured out a way to include a work around for parametrized column names. I had the same problem but came up with a different way and since I would be the only one using the column names then I believe this is still a safe bet.

            String sqlcomm = "SELECT * FROM Asset WHERE " + assetColName + " = ";
            command.CommandText = sqlcomm + "$assetColValue";

            //command.CommandText = @"SELECT * FROM Asset WHERE $assetColName = '$assetColValue'";
            //command.Parameters.AddWithValue("$assetColName", assetColName);

            command.Parameters.AddWithValue("$assetColValue", assetColValue);

As you can see from the code above. I tried almost what you did which I then had to comment out. I then concatenated strings together and was able to use my parametrized column name and value which then the value is securely added. The column name however is not secured but this is a method that only I will be using so its still somewhat safe. You can add regular expressions if you want to be more secure but you get the idea of the fix.

Answer 3

Just concatenate the sql string:

"UPDATE Contracts set " + columnName + " = @columnValue where ID = @ID"

Where column name is a string that represents a column in the table

Answer 4

Well, if you have 30,000 rows with 88 columns, and you need to update all 88 columns, you probably want to rethink your database schema.

Itay.