'System.InvalidCastException' в SqlCommand

Question

C# код:

  string d; 
     d = "did" + mission.Text; 
     int p = 0; 

     var command = string.Format("SELECT {0} FROM [User] WHERE Username = @name", d); 
     using (SqlCommand cBd = new SqlCommand(command, c)) 
     { 
      cBd.Parameters.AddWithValue("@name", txtuser.Text); 
      c.Open(); 
      p = (int)cBd.ExecuteScalar(); 
      c.Close(); 
     } 
     p++; 
     SqlCommand cmd = new SqlCommand("UPDATE [User] SET @mission = @par WHERE Username = @name",c); 
     cmd.Parameters.AddWithValue("@mission", d); 
     cmd.Parameters.AddWithValue("@par",p); 
     cmd.Parameters.AddWithValue("@name", txtuser.Text); 
     c.Open(); 
     cmd.ExecuteNonQuery(); 
     c.Close(); 

Ошибка:

An exception of type 'System.InvalidCastException' occurred in App_Web_sazkdh0g.dll but was not handled in user code

Additional information: Specified cast is not valid.

Answer 1

Правильный код:

  // In a using statement, acquire the SqlConnection as a resource. 
      using (SqlConnection con = new SqlConnection(connectionString)) 
      { 
       // 
       // Open the SqlConnection. 
       // 
       con.Open(); 
       // 
       // The following code uses an SqlCommand based on the SqlConnection. 
       // 
       string d; 
       d = "did" + mission.Text; 
       int p = 0; 

       var command = string.Format("SELECT {0} FROM [User] WHERE Username = @name", d); 
       using (SqlCommand cmd = new SqlCommand(command, con)) 
       { 
        cmd.Parameters.AddWithValue("@name", txtuser.Text); 
        p = (int)cmd.ExecuteScalar(); 
       } 

       command = string.Format("UPDATE [User] SET {0} = @par WHERE Username = @name", d); 
       using (SqlCommand cmd = new SqlCommand(command, con)) 
       { 
        cmd.Parameters.AddWithValue("@par", p); 
        cmd.Parameters.AddWithValue("@name", txtuser.Text); 
        cmd.ExecuteNonQuery(); 
       } 

      } 

Возможные sql injection в string.Format