Title: Update query updates all records except the name
Tags: c#;sql;windows-forms-designer
Question: I am stuck with an issue with updating. When I open my Windows form developed in C# using SQL, the update updates all fields but not the name. Could you tell me what I did wrong?

Here is my code

```    public void cc()
    {
        cbBname.Items.Clear();

        SqlCommand cmd = new SqlCommand();
        cmd.CommandType = CommandType.Text;
        cmd.CommandText = "select * from BkhurData";
        db.ExeNonQuery(cmd);

        DataTable dt = new DataTable();
        SqlDataAdapter da = new SqlDataAdapter(cmd);
        da.Fill(dt);
        foreach (DataRow dr in dt.Rows)
        {
            cbBname.Items.Add(dr["Name"].ToString());
        }
    }

    private void BkhurUpdate_Click(object sender, EventArgs e)
    {
        SqlCommand cmd = new SqlCommand();
        cmd.CommandType = CommandType.Text;
        cmd.CommandText = "update BkhurData set Name='" + tbBpname.Text + "',Details='" + tbBpdetails.Text + "',Price='" + tbBpprice.Text + "',Size='" + tbBpsize.Text + "', Quantity ='"+tbBpquantity.Text+"' where Name = '" + tbBpname.Text + "'";
        db.ExeNonQuery(cmd);

        tbBpname.Text = "";
        tbBpdetails.Text = "";

        tbBpprice.Text = "";
        tbBpsize.Text = "";
        tbBpquantity.Text = "";


        cc();

        MessageBox.Show("updated successfully");
    }
```

Comment: Where are you populating the variables? I would debug by getting the values here and then running your statement directly against SQL and compare.

Comment: This code is crazy vulnerable to sql injection

Comment: Can you show us what the query looks like after it parses the values of the textbox?

Comment: This is where i am populating the variables      public class Information3
    {
        //Storing String
      
        public string bkhurname { get; set; }
        public string bkhurdetails { get; set; }
        public string bkhurprice { get; set; }
        public string bkhursize { get; set; }
        public string bkhurquantity { get; set; }

Comment: Has the name in the `tbBpname.Text` actually changed? And if it has changed how do you expect the where statment to work.


Here is another answer: You are updating the ```Name``` where the ```Name``` equals ```tbBpname.Text```  so it will not change the name for row you are updating.

```private string originalName;
public void cc()
{
    cbBname.Items.Clear();

    SqlCommand cmd = new SqlCommand();
    cmd.CommandType = CommandType.Text;
    cmd.CommandText = "select * from BkhurData";
    db.ExeNonQuery(cmd);

    DataTable dt = new DataTable();
    SqlDataAdapter da = new SqlDataAdapter(cmd);
    da.Fill(dt);
    foreach (DataRow dr in dt.Rows)
    {
        cbBname.Items.Add(dr["Name"].ToString());
        originalName =  dr["Name"].ToString()
    }
}

private void BkhurUpdate_Click(object sender, EventArgs e)
{
    SqlCommand cmd = new SqlCommand();
    cmd.CommandType = CommandType.Text;
    cmd.CommandText = "update BkhurData set Name='" + tbBpname.Text + "',Details='" + tbBpdetails.Text + "',Price='" + tbBpprice.Text + "',Size='" + tbBpsize.Text + "', Quantity ='"+tbBpquantity.Text+"' where Name = '" + originalName+ "'";
    db.ExeNonQuery(cmd);

    tbBpname.Text = "";
    tbBpdetails.Text = "";

    tbBpprice.Text = "";
    tbBpsize.Text = "";
    tbBpquantity.Text = "";


    cc();

    MessageBox.Show("updated successfully");
}
```

Please note you should use SqlParameters and not build the query as a string.

Comment for this answer: How can i fix this issue when i take off the where it updates all the records to the name i selected for example if i had a records called "Hi" and "Bye" and modifying "bye" to "Good" it updates all records both "Hi" and "Bye" to "Good"
Comment for this answer: Could you please show me an example on how to fix this im really confused >.<
Comment for this answer: i have fixed the issue with making the where condition reads the name from the combobox instead of the textbox
Comment for this answer: You have to store the original name and use this in the where statement.
Comment for this answer: Updated my answer...hope it helps

{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 1, 'CommentCount': 5, 'ContentLicense': 'CC BY-SA 3.0', 'CreationDate': '2017:00:07/27/17', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<c#><sql><windows-forms-designer>', 'Title': 'Update query updates all records except the name', 'ViewCount': 41, 'id': 45360691, 'user_AboutMe': None, 'user_AccountId': 10960507.0, 'user_DisplayName': 'Dhary Almousa', 'user_Reputation': 11.0, 'user_Views': 7.0, 'user_id': 8053969.0}}