Updating SQL DB thru C#

Hi All!

I am trying to update a table in a DB through the code behind page of my ASP.NET site and the situation is that whenever a user is updating a product but doesn't select any images to upload then the DB entries for the image paths become NULL.

I check to see if the fileupload control has a file and if it doesn't then update the DB without the file. Here's my C# code:

Code:

protected void FormView1_ItemUpdating(object sender, FormViewUpdateEventArgs e)
    { 
      FileUpload FileUpload1 = (FileUpload)FormView1.FindControl("FileUpload3");
      FileUpload FileUpload2 = (FileUpload)FormView1.FindControl("FileUpload4");
      

      if (FileUpload1.HasFile)
      {
          string virtualFolder1 = "~/ProductArt/Thumb/";
          string physicalFolder1 = Server.MapPath(virtualFolder1);
          string oldkey = e.Keys["ItemID"].ToString();
          //string photopath1 = e.OldValues["ThumbPath"].ToString();
          string ext1 = System.IO.Path.GetExtension(FileUpload1.FileName);
          FileUpload1.SaveAs(System.IO.Path.Combine(physicalFolder1, oldkey + ext1));
          //e.Values["ThumbPath"] = photopath1 + ext1;
          e.NewValues["ThumbPath"] = virtualFolder1 + oldkey + ext1;
      }
      else
      {
          //throw new Exception("Error, no thumb file selected");
          SqlConnection connect = new SqlConnection("TTEConnectionString");
          connect.Open();
          SqlCommand cmdQuery = new SqlCommand(@"UPDATE Item SET ItemName='" + txtItemNameTextBox.Text + "', PublisherID='" + ddlPublisher.SelectedValue );
      }

      if (FileUpload2.HasFile)
      {
          string virtualFolder2 = "~/ProductArt/";
          string physicalFolder2 = Server.MapPath(virtualFolder2);
          string oldkey2 = e.Keys["ItemID"].ToString();
          //string photopath1 = e.OldValues["ThumbPath"].ToString();
          string ext2 = System.IO.Path.GetExtension(FileUpload2.FileName);
          FileUpload2.SaveAs(System.IO.Path.Combine(physicalFolder2, oldkey2 + ext2));
          //e.Values["ThumbPath"] = photopath1 + ext1;
          e.NewValues["PhotoPath"] = virtualFolder2 + oldkey2 + ext2;
      }
      else
      {
          throw new Exception("Error, no full box file selected");
      }
    }

I just can't seem to get it to work and also any names of asp controls i give show the "the name xxx doesn't exist in the current context" error.

 

You'll have to be a bit more descriptive than "it won't work". Is there an exception getting thrown? Any stack trace?

Also you should never execute sql queries like that as they're prone to sql injection attacks. Even though the framework may reject suspicious input there's still ways around it. Use an ORM instead like EntityFramework to make your life easier.

 

Code:

 SqlCommand cmdQuery = new SqlCommand(@"UPDATE Item SET ItemName='" + txtItemNameTextBox.Text + "', PublisherID='" + ddlPublisher.SelectedValue );

Where's your terminating ' at the end of PublisherID?

Also, where's your WHERE clause? Executing this is going to update every record in the [Item] table.

Did you omit the ExecuteNonQuery call? This code seems like it would do nothing.

This is pretty messy, I recommend using string.Format()

Code:

string sqlCommand = string.Format("UPDATE item SET ItemName=\'{0}\', PublisherID=\'{1}\'", txtItemNameTextBox.Text, ddlPublisher.SelectedValue); 

SqlCommand command = new SqlCommand(sqlCommand);

command.ExecuteNonQuery();

 

hmmm....i gave it a bit more thought and i decided to drop it into a 2 tier system where the thumbnail and full photos are not editable on the same level as the text information. so the user would need to click a link that takes them to another page and there it tells them to upload the thumb or full art.

 

Did you fix your problem though?

 

officially, no because it was outside the scope and i would be using time i don't have.

 

Please tell me this was a uni assignment and nothing more !!!