kankon says:
protected void Button1_Click(object sender, EventArgs e)
{
var sql = "update [Table_infoname] set [Countries] = 'DropDownList1.Text' where [States] like '%TextBox3.Text%'";
string str = ConfigurationManager.ConnectionStrings["cmConnectionString"].ConnectionString;
using (SqlConnection connection = new SqlConnection(str))
{
using (SqlCommand command = new SqlCommand(sql, connection))
{
connection.Open();
command.ExecuteNonQuery();
ClientScript.RegisterStartupScript(this.GetType(), "randomtext", " update()", true);
connection.Close();
}
}
}
Please use parameterized query.
protected void Button1_Click(object sender, EventArgs e)
{
string sql = "update [Table_infoname] set [Countries] = @Country where [States] like '%' + @State+ '%'";
string str = ConfigurationManager.ConnectionStrings["cmConnectionString"].ConnectionString;
using (SqlConnection connection = new SqlConnection(str))
{
using (SqlCommand command = new SqlCommand(sql, connection))
{
command.Parameters.AddWithValue("@Country", DropDownList1.SelectedItem.Text);
command.Parameters.AddWithValue("@State", TextBox3.Text);
connection.Open();
command.ExecuteNonQuery();
connection.Close();
ClientScript.RegisterStartupScript(this.GetType(), "randomtext", " update()", true);
}
}
}
For more details refer below article.
