title: Update sql record in c# wpf
body: <p>I have a User class that gets and sets data about users.</p>
  
  <pre><code>private string userId;  
          public string UserId
          {
              get { return userId; }
              set {
                  userId = value;
                  OnPropertyChanged(new PropertyChangedEventArgs("UserId"));
              }
          }
  
          private string employeeNumber;
          public string EmployeeNumber
          {
              get { return employeeNumber; }
              set {
                  employeeNumber = value;
                  OnPropertyChanged(new PropertyChangedEventArgs("EmployeeNumber"));
              }
          }
           ...
  </code></pre>
  
  <p>The data is retrieved from a select all query into an observablecollection and then displayed in a simple wpf window that has a combobox to list all users by userid and textboxes that displays the rest of the user data.  All this works great.  However, the edit/save has me over a barrel.</p>
  
  <p>After a text box is edited and the save button is clicked the following method is executed </p>
  
  <pre><code>private void btnSave_Click(object sender, RoutedEventArgs e)
      {
          User user = (User)grdUserManagement.DataContext;
          try
          {
              UserDB.UpdateUser(user);
          }
          catch (Exception ex)
          {
              MessageBox.Show(ex.ToString());
          }
      }
  </code></pre>
  
  <p>Obviously, the user passed to the Update statement is the new edited user. </p>
  
  <pre><code> public static void UpdateUser(User user)
      {
          SqlConnection connection = BusinessDB.GetConnection();
          string updateStatement =
              "UPDATE Employees SET userid = '" + user.UserId.ToString() + "', " +
              "password = '" + user.Password.ToString() + "', " +
              "empno = '" + user.EmployeeNumber.ToString() + "', " +
              "firstname = '" + user.FirstName.ToString() + "', " +
              "lastname = '" + user.LastName.ToString() + "' " +
              "WHERE (userid = '" + user.UserId + "' " +
              "OR userid IS NULL AND '" +user.UserId.ToString() + "' IS NULL) " +
              "AND (password = '" + user.Password.ToString() + "' " +
              "OR password IS NULL AND '" + user.Password.ToString() + "' IS NULL) " +
              "AND empno = '" + user.EmployeeNumber.ToString() + "' " +
              "AND firstname = '" + user.FirstName.ToString() + "' " +
              "AND lastname = '" + user.LastName.ToString() + "'";
  
               SqlCommand updateCommand = new SqlCommand(updateStatement, connection);
  
                try
          {
              connection.Open();
              updateCommand.ExecuteNonQuery();
          }
          catch (SqlException ex)
          {
              throw ex;
          }
          finally
          {
              connection.Close();
          }
  
      }
  </code></pre>
  
  <p>...nothing is saved because there is nothing in the table that matches the new 'edited' data.</p>
  
  <p>How do I write this to check for concurrency and update the record?</p>