Update Checkboxlist to database in asp.net C# - asp.net

Question

I want to update multi checkboxlist value to the the database. I already databound my checkboxlist from other table which is the medicine table. Now i want to update my value to consultation table, but i can not
`
protected void Page_Load(object sender, EventArgs e)
{
}
protected void Button1_Click(object sender, EventArgs e)
{
try
{
for (int i = 0; i < txtcheckbox.Items.Count - 1; i++)
{
if (txtcheckbox.Items[i].Selected == true)
{
str = str + txtcheckbox.Items[i].Text + ",";
}
}
SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString);
String sql = "UPDATE [consultation] set mname3 = " + str + " WHERE [conid] = #conid";
con.Open();
SqlCommand cmd = new SqlCommand(sql, con);
cmd.Parameters.AddWithValue("#conid", txtconid);
cmd.Parameters.AddWithValue("#mname3", str);
int j = cmd.ExecuteNonQuery();
if (j > 0)
{
Label2.Visible = true;
Label2.Text = "Successfully Complete Dispensary";
txtconid.Text = "";
}
else
{
Label2.Visible = true;
Label2.Text = "Not Successfully Complete Dispensary";
txtconid.Text = "";
}
con.Close();
}
catch
{
Label2.Visible = true;
Label2.Text = "Error";
txtconid.Text = "";
}
}
`

Answer 1

I guess you have exception here. Because:
String sql = "UPDATE [consultation] set mname3 = " + str + " WHERE [conid] = #conid";
here you use concatenation of strings and your sql query will look like:
UPDATE [consultation] set mname3 = sometextvale WHERE [conid] = #conid
mname3 have nvarchar sql type I guess, so you need to put string value in qoutes:
String sql = "UPDATE [consultation] set mname3 = ' " + str + " ' WHERE [conid] = #conid";
Or you can use paramaeter for sql query, like you already did for #conid:
String sql = "UPDATE [consultation] set mname3 = #mname3 WHERE [conid] = #conid";
It's better solution in security way.
Some additional comments:
for (int i = 0; i < txtcheckbox.Items.Count - 1; i++)
Are you sure here should be txtcheckbox.Items.Count - 1? You will lost the last one.
And the 2nd one: Mix code for construction and execution query (DAL) in code behind of page with some kind of business logic not a good practice =)