Using ASP.NET Razor Edit Data Page in WebMatrix - asp.net

Question

i have some problem here with Edit Data Using ASP.NET Razor in WebMatrix
i write this code for edit a data using the Update command but unfortunately it doesnt work :s :s
Razor code :
#{
{
var userId = Request["UserId"];
var db = Database.Open("intranet");
var query = "UPDATE Personne SET Demande = #0 WHERE UserId LIKE '%#1%'";
db.Execute(query,"refuser", userId);
}
}
the html code :
<form action="responsable.cshtml" method="post">
<input type="hidden" name="UserId" value="saadwafqui" />
<input type="submit" value="Oui" />
</form>

Answer 1

Your code is vulnerable to SQL injection. I would recommend you fixing this. Also you seem to be using some IsPost variable which is not quite clear where is being defined.
Example:
#{
var userId = Request["userid"];
var db = Database.Open("intranet");
var query = "UPDATE Personne SET Demande = #0 WHERE UserId LIKE '%' + #1 + '%'";
db.Execute(query, "refuser", userId);
}
Notice the syntax around the LIKE clause:
LIKE '%' + #1 + '%'
This will match all records that have UserId in the middle. If you wanted to match only records that the UserId starts with the value in the request:
LIKE '%' + #1
and if you wanted exact match simply use the = operator instead of a LIKE clause.
Also your markup looks completely broken. There's no window.location attribute. Maybe you meant something like this:
<form action="responsable.cshtml" method="post">
<input type="hidden" name="userid" value="saadwafqui" />
<input type="submit" value="Oui" />
</form>
or with a GET request if you prefer:
<form action="responsable.cshtml" method="get">
<input type="hidden" name="userid" value="saadwafqui" />
<input type="submit" value="Oui" />
</form>