Click here to Skip to main content
15,885,985 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
C#
private void cmdSave_Click(object sender, EventArgs e)
        {
            //dbcon.Open();
            try
            {
                dbcon.Open();
                SqlCommand chkID = new SqlCommand("Select ReceiveID from PolicyReceive where ReceiveID='" + txtRID.Text + "'", dbcon);
                string result = (string)chkID.ExecuteScalar();
                dbcon.Close();
                if (txtRID.Text == "")
                {
                    MessageBox.Show("Information Empty", "Information", MessageBoxButtons.OK, MessageBoxIcon.Information);
                }
                else if (result == txtRID.Text)
                {//update data

                    for (int item = 0; item <= dataGridView.Rows.Count - 1; item++)
                    {
                        cmd = new SqlCommand("UPDATE PolicyReceive SET ReceiveDate=@ReceiveDate,ReceiveType=@ReceiveType,ReceiveFrom=@ReceiveFrom,MobileNo=@MobileNo,FromZone=@FromZone,PolicyNo=@PolicyNo,PolicyType=@PolicyType,Remarks=@Remarks WHERE ReceiveID=@ReceiveID", dbcon);
                        cmd.Parameters.Clear();
                        cmd.Parameters.AddWithValue("@PolicyNo", dataGridView.Rows[item].Cells[1].Value);
                        cmd.Parameters.AddWithValue("@PolicyType", dataGridView.Rows[item].Cells[2].Value);
                        cmd.Parameters.AddWithValue("@ReceiveID", txtRID.Text);
                        cmd.Parameters.AddWithValue("@ReceiveDate", txtRDate.Text);
                        cmd.Parameters.AddWithValue("@ReceiveType", cmbRType.Text);
                        cmd.Parameters.AddWithValue("@ReceiveFrom", txtRByName.Text);
                        cmd.Parameters.AddWithValue("@MobileNo", txtMobile.Text);
                        cmd.Parameters.AddWithValue("@FromZone", cmbFZone.Text);
                        cmd.Parameters.AddWithValue("@Remarks", txtRemarks.Text);
                        dbcon.Open();
                        cmd.ExecuteNonQuery();
                        dbcon.Close();
                        dbcon.Close();
                    }
                    MessageBox.Show("Update DATA OK");
                    //dbcon.Close();
                    listView.Items.Clear();
                    dataView();
                    dbcon.Close();
                }
                else
                {
                    if (txtRID.Text == "")
                    {
                        MessageBox.Show("Plese Given Information", "Information", MessageBoxButtons.OK, MessageBoxIcon.Information);
                        txtPolicyNo.Focus();
                    }
                    else
                    {//Insert Data
                        for (int item = 0; item <= dataGridView.Rows.Count - 1; item++)
                        {
                            cmd = new SqlCommand("INSERT INTO PolicyReceive(ReceiveID,ReceiveDate,ReceiveType,ReceiveFrom,MobileNo,FromZone,PolicyNo,PolicyType,Remarks) values (@ReceiveID,@ReceiveDate,@ReceiveType,@ReceiveFrom,@MobileNo,@FromZone,@PolicyNo,@PolicyType,@Remarks)", dbcon);
                            cmd.Parameters.AddWithValue("@PolicyNo", dataGridView.Rows[item].Cells[1].Value);
                            cmd.Parameters.AddWithValue("@PolicyType", dataGridView.Rows[item].Cells[2].Value);
                            cmd.Parameters.AddWithValue("@ReceiveID", txtRID.Text);
                            cmd.Parameters.AddWithValue("@ReceiveDate", txtRDate.Text);
                            cmd.Parameters.AddWithValue("@ReceiveType", cmbRType.Text);
                            cmd.Parameters.AddWithValue("@ReceiveFrom", txtRByName.Text);
                            cmd.Parameters.AddWithValue("@MobileNo", txtMobile.Text);
                            cmd.Parameters.AddWithValue("@FromZone", cmbFZone.Text);
                            cmd.Parameters.AddWithValue("@Remarks", txtRemarks.Text);
                            dbcon.Open();
                            cmd.ExecuteNonQuery();
                            dbcon.Close();
                        }
                        MessageBox.Show("INSER DATA OK");
                        //dbcon.Close();
                        listView.Items.Clear();
                        dataView();
                        dbcon.Close();
                    }
                }
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message);
            }
            dbcon.Close();
        }


What I have tried:

I am facing the problem:There is no problem in inserting new data, but the data edit and edit state, if you insert new data, the previous data becomes the new data.


what i want to do,1. First, it will check through the ID, if the ID is the same, then it will edit and if it is a new ID, it will insert the data.
2. I inserted the data whose id is 7. This ID 7 has many policies and types. In this way I inserted more Kisu data. Now I will edit the policy on ID 7 and add some more policies. How do I do this?
Posted
Updated 25-Apr-23 9:29am
v2
Comments
Richard Deeming 26-Apr-23 3:32am    
"Select ReceiveID from PolicyReceive where ReceiveID='" + txtRID.Text + "'"


Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation/interpolation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

You already know how to use parameters - you've done it for the UPDATE and INSERT queries.

1 solution

You need to have two tables: one for the info that is common to all policies for a customer (or whatever the policies relate to) which has a unique ID row, and a second one which has a separate ID and a FOREIGN KEY which links back to ethe other table.
The first time you INSERT, you create the common data table row, then use the ID from that to create the second table data.
Subsequent INSERT operations only add a new row to the second table.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900