c# - syntax error missing operator in query expression -
when run below query, syntax error in query expression.
private void button8_click(object sender, eventargs e) { connection.open(); oledbcommand command = new oledbcommand(); command.connection = connection; string query1 = "update points set pnts = (case when empname = '" + combobox1.text + "' '" + label15.text + "' when empname = '" + combobox2.text + "' '" + label16.text + "' when empname = '" + combobox3.text + "' '" + label17.text + "' end) empname in ('" + combobox1.text + "', '" + combobox2.text + "', '" + combobox3.text + "')"; command.commandtext = query1; command.executenonquery(); connection.close(); }
the error is:
syntax error (missing operator) in query expression '(case when empname = 'sam' '5.6' when empname = 'shane' '1.6' when empname = 'mike' '0.8' end)'.
you have syntax error in sql (ms access not feature case expressions). rewrite source line follows:
string query1 = "update points set pnts = " + "switch (" + " empname = '" + combobox1.text + "', '" + label15.text + "'" + ", empname = '" + combobox2.text + "', '" + label16.text + "'" + ", empname = '" + combobox3.text + "', '" + label17.text + "'" + ", true, ''" + ")" + " empname in ('" + combobox1.text + "', '" + combobox2.text + "', '" + combobox3.text + "')" ;
to counter risk of sql injection, consider use parametrized sql commentors have suggested:
oledbparameter parameter; // n-th generic placeholder in sql string set n-th registered parameter value. // '12' represents data size, adjustment may needed ( can possibly dropped altogether ) parameter = command.parameters.add("@inputparm", oledbtype.varchar, 12); parameter.value = combobox1.text; parameter = command.parameters.add("@inputparm", oledbtype.varchar, 12); parameter.value = label15.text; parameter = command.parameters.add("@inputparm", oledbtype.varchar, 12); parameter.value = combobox2.text; parameter = command.parameters.add("@inputparm", oledbtype.varchar, 12); parameter.value = label16.text; parameter = command.parameters.add("@inputparm", oledbtype.varchar, 12); parameter.value = combobox3.text; parameter = command.parameters.add("@inputparm", oledbtype.varchar, 12); parameter.value = label17.text; parameter = command.parameters.add("@inputparm", oledbtype.varchar, 12); parameter.value = combobox1.text; parameter = command.parameters.add("@inputparm", oledbtype.varchar, 12); parameter.value = combobox2.text; parameter = command.parameters.add("@inputparm", oledbtype.varchar, 12); parameter.value = combobox3.text; string query1 = "update points set pnts = " + "switch (" + " empname = ?, ?" + " empname = ?, ?" + " empname = ?, ?" + ", true, ''" + ")" + " empname in (?, ?, ?)" ;
caveat
code untested, derived docs.
Comments
Post a Comment