c# - Update multiple mysql columns using parametarized update command -

In my application, I want to update the multiple MySQL columns using the UPDATE command. I tried it with the following code, but I know that it is really unsafe because it is how a query with parameters to update SQL injection led to the attacks, but I do not know that multiple MySQL column to write I < / P>

This is my code:

  string constring = string.Format ("datasource = '{0}'; port = '{1}'; database = '{2 } '; Username = Claimproof; password = xxxxxxxxxxxxxxxx; Connect timeout; 180; Mand timeout = 180 ", Srhwarplebl. Text, Porto. Text, Databesmanabl. Text); String query = '+ this.loannumbertextbox.Text.Trim () +', pool = '' + this.loanpooltextbox.Text.Trim () + '', disblid = '' + This "update claimloans loannumber = set". disbidtextbox.Text.Trim () + '', class = '' + this.categorytxtbox.Text.Trim () + '', subcacategory = '' + this.subcategorytxtbox.Text.Trim () + '', invoices = ' "+ this.invoicenumbertextbox.Text.Trim () + '', invoicedate = '' + this.invoicedatetextbox.Text.Trim () + '', docs = '' + this.docscombobox.Text.Trim () + '' , Where user name = '"+ this.usernamelable.Text.Trim () +"'; "; MySqlConnection conwaqDatabase = New MySqlConnection (constring); MySqlCommand cmdwaqDatabase = New MySqlCommand (query, conwaqDatabase); MySqlDataReader myreader; Try {conwaqDatabase.Open (); Myreader = cmdwaqDatabase.ExecuteReader (); While (myreader.Read ()) {} MessageBox.Show ("Credential informations are updated"); ConwaqDatabase.Close (); } Hold {}  

You can use something like this. You add the place holders in the SQL command and then you run the ExecuteReader then add the parameter value later. string constring = String.Format ("data source = '{0}'; port = '{1}'; database = '{2}', username = claimsprologin; password = gfx) C # G $ aD3bL` @; connect timeout = 180; command timeout = 180 ", serveriplable.Text, portno.Text , Databasenamelable .text); String query = "UPDATE claimloans set loannumber = @loannumbertextbox, pool = @loanpooltextbox, disblid = @disbidtextbox, range = @categorytxtbox, subcacategory = @subcategorytxtbox, invoice = @invoicenumbertextbox, invoicedate = @invoicedatetextbox, docs = @docscombobox, where username = @usernamelable, "; MySqlConnection conwaqDatabase = New MySqlConnection (constring); MySqlCommand cmdwaqDatabase = New MySqlCommand (query, conwaqDatabase); CmdwaqDatabase. Parameter. AddWithValue ("@lumbertextbox", this.loannumbertextbox.Text.Trim ());