unable to update filed lastlogin

Question

0.00/5 (No votes)

See more:

login.cs

C#

boolReturnValue = true;
Session["UserId"] = dt.Rows[0]["Id"].ToString();
string updateLastLogin = "UPDATE [User] SET LastLogon = GETDATE() where Id= @UserId";
dbClass.ConnectDataBaseToInsert(updateLastLogin);

error comes
Must declare the scalar variable "@UserId".

Posted 14-Apr-11 0:37am

om56

Updated 14-Apr-11 0:39am

Wild-Programmer

v2

Add a Solution

4 solutions

Solution 4

Without seeing your dbClass definition, it is difficult to be precise, but I would add an overload:

dbClass.ConnectDataBaseToInsert(updateLastLogin, "@userID", Session["UserId"]);

unless your class already has a method set up for adding properties.
Please, do not convert this to a concatenated string as it leave you wide open for an SQL Injection attack via the user ID.

Posted 14-Apr-11 0:47am

OriginalGriff

Comments

BobJanova 14-Apr-11 9:11am

Or, dbClass.UpdateLastLogon(Session["UserId"]). That method, of course, should build a parameterised query, as should the one in your proposal.

OriginalGriff 14-Apr-11 9:17am

Good idea!

Solution 2

you're getting the error because you're referencing @UserId even though it hasn't been declared. As you're using your own data access layer I'd replace the @UserId with the Id value you put in Session on the previous line.

Posted 14-Apr-11 0:43am

jim lahey

Solution 3

bool ReturnValue = true;
Session["UserId"]=dt.Rows[0]["Id"].ToString();
string updateLastLogin = "Update [User] SET LastLogon=getdate() where ID = " + Session["UserId"].ToString();
dbClass.ConnectDataBaseToInsert(updateLastLogin)

Posted 14-Apr-11 0:45am

MaulikDusara

Comments

OriginalGriff 14-Apr-11 7:03am

Bad idea! The whole idea of using Parametrized queries is to avoid an SQL injection attack, not make it easier!

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Wild-Programmer · Accepted Answer · 2011-04-14T00:42:00

Solution 1

Where have you defined @UserId, since it is a single line string query, you need to put value instead of @UserId.

It should be like

C#

string updateLastLogin = "UPDATE [User] SET LastLogon = GETDATE() where Id= " + Session["UserId"].ToString();

Posted 14-Apr-11 0:42am

Wild-Programmer

Comments

OriginalGriff 14-Apr-11 6:44am

Bad idea! The whole idea of using Parametrized queries is to avoid an SQL injection attack, not make it easier!

Wild-Programmer 15-Apr-11 5:28am

I know its bad idea. I was just correcting OP's code ;) with his approach.