Click here to Skip to main content
15,891,951 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
C#
cmd.CommandType = CommandType.Text;
               cmd.Connection = sqlcon;
               cmd = new SqlCommand("update  TBL_InvoicContent set pid='" + txtpid.Text + "',remainder='" + txtremainder.Text + "' where  id_invoice= " + txtidincon.Text + "  and fk_id_product = " + txtidItems.Text + " ", sqlcon);

               sqlcon.Open();
               cmd.ExecuteNonQuery();
               MessageBox.Show("Edited");
               sqlcon.Close();
Posted
Comments
syed shanu 11-Jan-15 19:28pm    
Do you mean after you update data you want to refresh the Datagridview and display with update data.If so then after update you have to rebind the Datagridview.

1 solution

I would suggest you use binding. There are many manuals; and the UI refresh problem (including DataGridView refresh) was discussed too many times; you will find a lot of material with code samples:
http://msdn.microsoft.com/en-us/library/2b4be09b.aspx[^] (original MSDN article),
http://tech.pro/tutorial/664/csharp-tutorial-binding-a-datagridview-to-a-database[^],
http://csharp.net-informations.com/datagridview/csharp-datagridview-database-operations.htm[^],
http://stackoverflow.com/questions/21284548/how-to-synchronize-database-and-datagridview[^],
http://stackoverflow.com/questions/10888561/refresh-datagridview-win-forms-after-updating-the-database-from-a-child-form[^].

But you have much worse problem with your query. Your approach is wrong from the very beginning. Your query is composed by concatenation with strings taken from UI. Not only repeated string concatenation is inefficient (because strings are immutable; do I have to explain why it makes repeated concatenation bad?), but there is way more important issue: it opens the doors to a well-known exploit called SQL injection.

This is how it works: http://xkcd.com/327[^].

What to do? Just read about this problem and the main remedy: parametrized statements: http://en.wikipedia.org/wiki/SQL_injection[^].

With ADO.NET, use this: http://msdn.microsoft.com/en-us/library/ff648339.aspx[^].

Please see my past answers for some more detail:
EROR IN UPATE in com.ExecuteNonQuery();[^],
hi name is not displaying in name?[^].

—SA
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900