Here is what I use for performing updates where in this case OcsMessage
is an instance of a class, modifying to use other containers as you see fit such as a DataRow or DataTable (where a DataTable makes zero sense unless updating all rows in the DataTable).
public bool UpdateRecord(OcsMessage messageRecord)
{
mHasException = false;
bool success = false;
var updateStatement = @"
UPDATE OCS_MESSAGES SET
OCS_MESSAGE_TXT = :MessageText,
OCS_LANG_CODE = :LanguageCode,
OCS_FORM_FIELD_NAME = :FormFieldName,
OCS_FORM_FIELD_ORDER = :FormFieldOrder
WHERE ID = :Identifier";
using (var cn = new OracleConnection() { ConnectionString = "TODO") })
{
using (var cmd = new OracleCommand() { Connection = cn })
{
try
{
cmd.BindByName = true;
cmd.CommandText = updateStatement;
cmd.Parameters.Add(":MessageText", messageRecord.MessageText);
cmd.Parameters[":MessageText"].Size = 2000;
cmd.Parameters.Add(":LanguageCode", messageRecord.LanguageCode);
cmd.Parameters.Add(":FormFieldName", messageRecord.FormFieldName);
cmd.Parameters.Add(":FormFieldOrder", messageRecord.FormFieldOrder);
cmd.Parameters.Add(":Identifier", messageRecord.id);
cn.Open();
cmd.ExecuteNonQuery();
success = true;
}
catch (OracleException oex)
{
// TODO
}
catch (Exception ex)
{
// TODO
}
}
}
return success;
}
Should never use string concatenation, always used parameters e.g. for Oracle :MessageText
and BindByName.