Error When Trying To Update Values In Database

I have the following c#/Query: TrackDuration =TimeSpan.Parse( Request.Form['TrackDuration'].ToString()); string InsertQuery = string.Format('UPDATE tblTracks SET TrackLength={0},

Solution 1:

'02:30:00' is not a correct value for datetime DB field, AFAIK. The default format is controlled by date format setting.

Additionally, '20130412' should work in any case, but for datetime field. You need to format the TrackDuration correctly or use CAST/CONVERT. As TimeSpan doesn't contain date part (it represents a duration and not a point in time), you can only make it up (e.g. prepend "20100101") but that is an awful hack.

The proper solution is to use the correct DB field type.

'02:30:00' might work if the field was of time type. Please read some more about time types in SQL Server.

Even better, why don't you use plain integer for the duration in seconds? The duration is not a date anyway.

The much bigger issue is that you are concatenating strings to set the command text, which opens you for SQL injection attack. If I name the racing track a';DROP TABLE tblTracks;-- your database is toast:

UPDATE tblTracks SET TrackLength=35, 
                     TrackDuration='02:30:00', 
                     TrackName='a';DROP TABLE tblTracks;-- ...