How to use both insert and update query on the same page in C# ASP.NET

Question

0.00/5 (No votes)

See more:

i have a order summary page on which fields are being populated from the cart table.I I have added one new text box on the same page which contains the date. I want the user to enter the date in the text box and then all the information will be saved in the cart table. please let me know how to use both insert and update query on the same c# page

What I have tried:

SqlConnection con = new SqlConnection();
        con.ConnectionString = "Data Source=.\\sqlexpress;Initial Catalog=college_education;User ID=sa;Password=system;";
        con.Open();
        string q = "update cart set status='CO' Where user_name='" + Session["user"] + "' and status='ATC'";
        SqlCommand com = new SqlCommand(q,con);
        com.ExecuteNonQuery();
        {
             Response.Write("<script>alert('Your Order is Placed Successfully. Our Agent will contact you shortly.')</script>");
        }

Posted 19-Oct-17 20:01pm

Member 12950401

Updated 19-Oct-17 22:46pm

Add a Solution

Comments

Karthik_Mahalingam 20-Oct-17 2:19am

what is the problem? add insert code also.

Member 12950401 20-Oct-17 3:36am

Dear Karthik..i want to use both update and insert statement at the same time on same page. i have only one button and that button will update some fields in database and insert into some fields in database of the same table. is it possible

Richard Deeming 20-Oct-17 11:09am

Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

Richard Deeming 20-Oct-17 11:10am

Also, your application should NEVER connect to the database as the sa user. That's an unrestricted user, which could be used to destroy your database, your server, or even your entire network.

Connect as a specific user which has only the permissions required by your application.

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Karthik_Mahalingam · Accepted Answer · 2017-10-19T22:23:00

Solution 1

Op Wrote:
.i want to use both update and insert statement at the same time on same page. i have only one button and that button will update some fields in database and insert into some fields in database of the same table. is it possible

Yes,

string update = "update cart set status='CO' Where user_name= @user and status='ATC'";
           string insert = "Your insert statement";
           string query = update + " ; " + insert;
           SqlCommand com = new SqlCommand(query, con);
           com.Parameters.AddWithValue("@user", Session["user"]);
           com.ExecuteNonQuery();

Posted 19-Oct-17 22:23pm

Karthik_Mahalingam

Comments

Member 12950401 20-Oct-17 5:15am

thanks karthink...now i have another question. I have a hyperlink on one asp.net page. the name of the hyperlink is "process" and using that hyperlink i want to store some information available in the textbox(by the name note) on another page in the table cart. how is it possible.

Karthik_Mahalingam 20-Oct-17 5:31am

using that hyperlink i want to store some information available in the textbox(by the name note) on another page in the table cart.
not clear, Please explain

Member 12950401 20-Oct-17 5:48am

i have page which has few labels and a text box. labels are showing the value from the database. i have to write something in the textbox and then save the text box value in the table. for saving the text box value i donot have button but a hyperlink. The name of the hyperkink is "process". once i click on the process link, system moves to the process.aspx page. this page has no aspx code but the c# code. the code is as below.

SqlConnection con = new SqlConnection();
con.ConnectionString = "Data Source=.\\sqlexpress;Initial Catalog=college_education;User ID=sa;Password=system;";
con.Open();
string v = Request.QueryString["id"];
SqlCommand comnd = new SqlCommand("update cart set status='Pr' where user_name='" + v + "'", con);
comnd.ExecuteNonQuery();
{
Response.Write("alert('cart processed successfully')");
}
//Response.Redirect("welcome_admin.aspx");

i want to modify above code so that i can also add textbox info in the table cart.

Karthik_Mahalingam 20-Oct-17 5:57am

if you want to passs any data from one page to other page you shall refer these
State Management in ASP.NET - Introduction[^]

F-ES Sitecore · Accepted Answer · 2017-10-19T22:46:00

SqlConnection con = new SqlConnection();
        con.ConnectionString = "Data Source=.\\sqlexpress;Initial Catalog=college_education;User ID=sa;Password=system;";
        con.Open();
        string q = "update cart set status='CO' Where user_name='" + Session["user"] + "' and status='ATC'";
        SqlCommand com = new SqlCommand(q,con);
        com.ExecuteNonQuery();
        {
             Response.Write("<script>alert('Your Order is Placed Successfully. Our Agent will contact you shortly.')</script>");
        }

        q = "PUT YOUR INSERT STATEMENT HERE;
        com = new SqlCommand(q,con);
        com.ExecuteNonQuery();