Why this simple query breaks? [closed] - asp.net

Question

Closed. This question needs details or clarity. It is not currently accepting answers.
Want to improve this question? Add details and clarify the problem by editing this post.
Closed 8 years ago.
Improve this question
I have a asp.net application, which save some users data using post form. For that I have a simple query listed below.
"UPDATE myTable SET LastUpdatedOn='"
+ DateTime.UtcNow + "', Completed='1'
WHERE ID='" + requestid + "'"
This fails some times. But I think there are no issue with it. So please let me know why it happens.

Answer 1

You should familiarize yourself with parameterized queries, and start using them to protect your system from SQL Injection attacks.
using (var cmd = conn.CreateCommand()) {
cmd.CommandText =
"UPDATE myTable SET LastUpdatedOn=#Time, Completed='1' WHERE ID=#Id";
cmd.Parameters.AddWithValue("#Time", DateTime.UtcNow);
cmd.Parameters.AddWithValue("#Id", requestid);
var count = cmd.ExecuteNonQuery();
if (count != 1) {
Console.Error.WriteLine(
"Warning: Cannot update myTable for ID {0}", requestid
);
}
}
As an added benefit, this approach eliminates all possible data formatting issues, and speeds up your queries by letting SQL Server cache query plans. But the main benefit is thwarting the attempts of "Bobby Tables" of the world to gain unauthorized access to your system.

Answer 2

DateTime.UtcNow is not likely parseable to a datetime for the query. Try:
DateTime.UtcNow.ToString('yyyy-MM-dd hh:mm:ss')
(also, I may have screwed up my "m's", so double check it)

Answer 3

I'm not exactly sure why this would break. We would need to see the schema of the table to get a better idea of what could be going wrong. On another note, I would suggest that you use parameterized queries instead of simply concatenating your query. Your current query could be vulnerable to SQL injection depending on where the inputs come from. Try changing your code to something like this to see if it alleviates the error (this will also mitigate the SQL injection risk):
SqlCommand cmd = new SqlCommand("UPDATE myTable SET LastUpdatedOn = #LastUpdatedOn, Completed = #Completed WHERE ID = #RequestId", sqlConnectionObject);
cmd.Parameters.AddWithValue("#LastUpdatedOn", DateTime.UtcNow);
cmd.Parameters.AddWithValue("#Completed", 1);
cmd.Parameters.AddWithValue("#RequestId", requestid);
cmd.ExecuteNonQuery();

Answer 4

insted of using DateTime.UtcNow consider to use getdate() if Sql Sevrer or simmilar function in whatever database you are using
"UPDATE myTable SET LastUpdatedOn= getdate(), Completed='1' WHERE ID='" + requestid + "'"