Question about C # and SQL

Question

I want to update an existing record .. the way that I paste my code here, I successfully completed my task, but I don’t want to do the update in this way actually. I want to make sure that I get the client ID.

private void btnUpdate_Click(object sender, EventArgs e)
        {
            SqlConnection cn = new SqlConnection(@"Data Source=COMPAQ-PC-PC\SQLEXPRESS;Initial Catalog=Gym;Integrated Security=True");
            if (cn.State == ConnectionState.Closed)
            {
                cn.Open();
            }
            int result = new SqlCommand("Update Customer set Customer_Name = '" + tbName.Text + "',Cell_Number = '" + tbContactNumber.Text + "',Customer_Address = '" + tbAddress.Text + "' where CustomerID = " + tbID.Text, cn).ExecuteNonQuery();
            if (cn.State == ConnectionState.Open)
            {
                cn.Close();
            }
            cn.Dispose();

            BindGridView();
        }

private void BindGridView()
        {
            SqlConnection cn = new SqlConnection(@"Data Source=COMPAQ-PC-PC\SQLEXPRESS;Initial Catalog=Gym;Integrated Security=True");
            SqlCommand cmd = new SqlCommand("Select * from Customer", cn);
            SqlDataAdapter da = new SqlDataAdapter(cmd);
            DataTable dt = new DataTable();
            da.Fill(dt);
            dgView_CustomerInfo.DataSource = dt.DefaultView;
        }

private void dgView_CustomerInfo_RowHeaderMouseClick(object sender, DataGridViewCellMouseEventArgs e)
        {

            tbID.Text = dgView_CustomerInfo.Rows[e.RowIndex].Cells["CustomerID"].Value.ToString();
            tbName.Text = dgView_CustomerInfo.Rows[e.RowIndex].Cells["Customer_Name"].Value.ToString();
            tbContactNumber.Text = dgView_CustomerInfo.Rows[e.RowIndex].Cells["Cell_Number"].Value.ToString();
            tbAddress.Text = dgView_CustomerInfo.Rows[e.RowIndex].Cells["Customer_Address"].Value.ToString();
        }

Answer 1

Gorilla's coding above has already given you a great answer, and I support it.

The question that you ask, 20 minutes after that, is: "Hey, how did all these hackers get my data?"

The above method is RIPE for SQL Injection. Read about it here: http://www.securiteam.com/securityreviews/5DP0N1P76E.html

. .

Answer 2

, : , .

, ViewState :

public int CustomerId
{
   get { return (int)(ViewState["CustomerId"] ?? -1); }
   set { ViewState["CustomerId"] = value; }
}

ViewState : http://msdn.microsoft.com/en-us/library/system.web.ui.control.viewstate.aspx

** EDIT **

Windows, ViewState , ASP.NET. BindingSource Databind Winforms.

Answer 3

Do not SQL!

Parameter.