Error saving BD change in C#

Question

I have a certain error when making changes to some data registered in the database, picture below the error

also follows the code used:

private void btnSalvar_Click(object sender, EventArgs e)
{
            conectar.Open();
            //Convertendo

            Converter = Convert.ToInt32(txtQuantidade.Text);
            converterdata = Convert.ToDateTime(DTPEntrada.Text);


            MySqlCommand Inserir = new MySqlCommand();
            Inserir.Connection = conectar;
            Inserir.CommandText = "UPDATE  Pacote SET Nome = '" + txtNome.Text + 
                "', Quantidade = '" + Converter + "', peca =" + cbxPeca.Text + 
                ", Data_entrada = " + converterdata + " WHERE ID_Pacote =" + alterar2 +  " ";


            Inserir.ExecuteNonQuery();
            conectar.Close();
            alterar2 = 0;
            txtNome.Text = "";
            txtQuantidade.Text = "";
            //txtDescricao.Text = "";
            MessageBox.Show("Pacote alterado", "Concluido",
              MessageBoxButtons.OK,
              MessageBoxIcon.Information);
            selecionarCategoria();


        }

Also follows the Bank Code:

    CREATE DATABASE ProdPacote;
USE ProdPacote;

CREATE TABLE Produto(
ID_Produto INT PRIMARY KEY AUTO_INCREMENT,
Nome VARCHAR (200) NOT NULL,
Descricao VARCHAR (200) NOT NULL,
Preco DOUBLE NOT NULL,
`status` TINYINT NOT NULL);  

CREATE TABLE Pacote(
ID_Pacote INT PRIMARY KEY AUTO_INCREMENT,
Nome VARCHAR (200) NOT NULL,
peca VARCHAR (200) NOT NULL,
Quantidade INT NOT NULL,
Data_entrada DATETIME NOT NULL);





CREATE TABLE Produto_Pacote(
ID_Produto_Pacote INT PRIMARY KEY AUTO_INCREMENT,
Data_Hora DATE NOT NULL,
FK_ID_Produto INT NOT NULL,
FK_ID_Pacote INT NOT NULL,

CONSTRAINT Produto_Pacote
FOREIGN KEY (FK_ID_Produto)
REFERENCES Produto (ID_Produto),

CONSTRAINT Pacote_Produto
FOREIGN KEY(FK_ID_Pacote)
REFERENCES Pacote(ID_Pacote));

Answer 1

The ideal is to do the Insert as in the example below:

MySqlConnection conn = new MySqlConnection(connString);
conn.Open();
MySqlCommand cmd = conn.CreateCommand();

cmd.CommandText = @"UPDATE  Pacote SET Nome = ?Nome, Quantidade = ?Quantidade, 
                   peca = Peca ,Data_entrada = ?Data WHERE ID_Pacote = ?ID";

cmd.Parameters.Add("?Nome", MySqlDbType.VarChar).Value = txtNome.Text;
cmd.Parameters.Add("?Quantidade", MySqlDbType.Int32).Value = Converter;
cmd.Parameters.Add("?peca", MySqlDbType.VarChar).Value = cbxPeca.Text;
cmd.Parameters.Add("?Data", MySqlDbType.Date).Value = converterdata;
cmd.Parameters.Add("?ID", MySqlDbType.Int32).Value = alterar2;
cmd.ExecuteNonQuery();
conn.Close();

There are several questions here at Sopt that explain why it should not be as it is in your question:

1. /a/361517/35358
2. Why parameterized SQL queries (name = ?) prevent SQL Injection?
3. How an SQL Injection Happens?

Answer 2

There are a number of problems there, but the main problem (which is causing the error in the case) is that your SQL command is wrong. You probably wrote something wrong precisely because it is very difficult to read this concatenation-filled code and understand something.

For easy reading, find the problem and still break avoid SQL Injection, use parameters.

inserir.CommandText = @"UPDATE Pacote SET Nome = @NOME,
                                          Quantidade = @QUANTIDADE, 
                                          Peca = @PECA, 
                                          Data_entrada = @DT_ENTRADA 
                                          WHERE ID_Pacote = ID_PACOTE"

command.Parameters.Add("@NOME", SqlDbType.VarChar);
command.Parameters["@NOME"].Value = txtNome.Text;
// ... Continue para todos os parâmetros

Now that I’ve rewritten your SQL, I realize the errors:

• The value of Quantidade is in quotes - I imagine it’s an integer;
• The value of Peca is not in quotes