How to create command line update fields from the board

Question

I have a job to insert, update and delete. The insert and delete are working properly. So, I have a problem with the update that that would be:

 cmd.CommandText = "Update carros set placa='" + campoplaca.Text + "', marca='" + campomarca.Text + "' where placa='" + campoplaca.Text + "' and marca= '" + campomarca.Text + "'";

In my project I have as values :

id=int pk
placa=nvarchar
marca=nvarchar
modelo=nvarchar
combustivel=nvarchar
potencia=int
ano=int
preco=int

So my question is how to proceed with this command line. Where already exists plate and mark, my wish Where is to change by the board and then the other fields. More will be needed the and in all?

private void btAtualizar_Click(object sender, EventArgs e)
        {
            SqlCeConnection conn;
            try
            {
                conn = new SqlCeConnection(" Data Source = C:\\Users\\Admin\\Documents\\Visual Studio 2015\\Projects\\WindowsFormsArrayEx03\\BD_Teste.sdf; Password ='' ");
                conn.Open();
                MessageBox.Show("ATUALIZADO!!!");

            SqlCeCommand cmd = conn.CreateCommand();

            cmd.CommandText = "Update carros set placa='" + campoplaca.Text + "', marca='" + campomarca.Text + "' where placa='" + campoplaca.Text + "' and marca= '" + campomarca.Text + "'";

            cmd.ExecuteNonQuery();
            conn.Close();
        }
        catch (Exception ex)

        {
            MessageBox.Show(ex.StackTrace);

        }
    }

Answer 1

First, it is not advisable to concatenate sql statements as you did.

cmd.CommandText = "Update carros set placa='" + campoplaca.Text + "', marca='" + campomarca.Text + "' where placa='" + campoplaca.Text + "' and marca= '" + campomarca.Text + "'";

See a possibility for your example, make your where using the table’s primary key. So that way you can change both the placa as the marca in the same instruction update.

cmd.CommandText = "Update carros set placa=@placa, marca=@marca where id=@id";
cmd.Parameters.Add(new SqlParameter { ParameterName = "@placa", Value = placa });
cmd.Parameters.Add(new SqlParameter { ParameterName = "@marca", Value = marca });
cmd.Parameters.Add(new SqlParameter { ParameterName = "@id", Value = id});