C# refund SQL syntax -

i wrote inventory software; have 3 forms 1st 1 had items inventory 2nd 1 sell items inventory , last 1 can refund items sold.

i have problem refund command, here code:

try {     mycon.open();     int y = 0;      (int = 0; < datagridview1.rows.count; i++)     {         sqlcommand cmd5 = new sqlcommand("update pharmacy_items set quantity= quantity + " + datagridview1.rows[y].cells[4].value + " , sold= sold - " + datagridview1.rows[y].cells[4].value + " itemname='" + datagridview1.rows[y].cells[1].value + "'", mycon);         cmd5.executenonquery();         y += 1;     }      mycon.close(); }  

with code want add items stock again sometime doesn't work , didn't add items , change items not right. there wrong code or way using?

thanks

sorry bad english : )

use parameterized query more readable , recommended way.

try         {             mycon.open();             int y = 0;             (int = 0; i<datagridview1.rows.count; i++)             {                  string sql = "update [dbo].[pharmacy_items] set quantity= quantity + @quantity , sold= sold - @sold itemname=@itemname";                  using (sqlcommand cmd5 = new sqlcommand(sql, mycon))                 {                     cmd5.commandtype = commandtype.text;                     var qunatityparam = new sqlparameter{value=datagridview1.rows[y].cells[4].value, sqldbtype=sqldbtype.int, parametername="quantity"};                     var soldparam = new sqlparameter{value=datagridview1.rows[y].cells[4].value, sqldbtype = sqldbtype.int, parametername = "sold"};                     var itemnameparam = new sqlparameter{value=datagridview1.rows[y].cells[1].value,sqldbtype = sqldbtype.varchar, parametername = "itemname"};                      cmd5.parameters.add(qunatityparam);                     cmd5.parameters.add(soldparam);                     cmd5.parameters.add(itemnameparam);                     cmd5.executenonquery();                 }                  y += 1;             }             mycon.close();         }  

or better way write stored procedure in sql end , call c# code below prevents sql injection.

sql

create procedure editpharmacyitems      @quantity int,     @sold int,     @itemname varchar(max) begin      set nocount on;      update pharmacy_items      set quantity = quantity+@quantity      ,sold = sold - @sold      itemname =@itemname end go 

c#

            try             {                  string sqlquery = "[dbo].[editpharmacyitems]";                 int y = 0;                 mycon.open();                  (int = 0; i<datagridview1.rows.count; i++)                 {                     sqlcommand cmd5 = new sqlcommand(sqlquery, mycon);                     cmd5.commandtype=commandtype.storedprocedure;                     var qunatityparam = new sqlparameter{value=datagridview1.rows[y].cells[4].value, sqldbtype=sqldbtype.int, parametername="quantity"};                     var soldparam = new sqlparameter{value=datagridview1.rows[y].cells[4].value, sqldbtype = sqldbtype.int, parametername = "sold"};                     var itemnameparam = new sqlparameter{value=datagridview1.rows[y].cells[1].value,sqldbtype = sqldbtype.varchar, parametername = "itemname"};                       cmd5.parameters.add(qunatityparam);                      cmd5.parameters.add(soldparam);                      cmd5.parameters.add(itemnameparam);                      cmd5.executenonquery();                                      y += 1;                 }                 mycon.close();             }