Doubt with sql command in c#

Question

SqlCommand comm =
new SqlCommand("UPDATE Contatos Set Telefone=" + " ' " + txtTelefone.Text + " ' " + ",Cidade=" + " ' " + txtCidade.Text + " ' " + ",Email=" + " ' " + txtEmail.Text + " ' " + ",Endereco=" + " ' " + txtEndereco.Text + " ' " + "WHERE Nome=" + txtNome.Text, conn);

Error: "Column name 'the name that is in the invalid txtNome". The error message shows as if I was trying to find the name of a column, where the column name is txtNome.Text. My intention was for the sql command to update the contact information according to its name. I have little experience with sql and can’t see where my error is.

Answer 1

This is the bad way to fire an SQL command. It is correct to create parameters for each field that will be updated:

SqlCommand comm = new SqlCommand("UPDATE Contatos Set Telefone = @Telefone, " +
                                 "Cidade = @Cidade, " +
                                 "Email = @Email, " +
                                 "Endereco = @Endereco " +
                                 "WHERE Nome = @Nome", conn);

comm.Parameters.AddWithValue("@Telefone", txtTelefone.Text);
comm.Parameters.AddWithValue("@Cidade", txtCidade.Text);
comm.Parameters.AddWithValue("@Email", txtEmail.Text);
comm.Parameters.AddWithValue("@Endereco", txtEndereco.Text);
comm.Parameters.AddWithValue("@Nome", txtNome.Text);

Answer 2

In the clause Where failed to concatenate with simple quotes. Follows example below.

But you’d better take the advice that Gypsy Morrison Mendez gave.

"WHERE Nome=" + "'" + txtNome.Text + "'", conn);