c# - Error when trying to update values in database

Question

I have the following c#/Query:

TrackDuration =TimeSpan.Parse( Request.Form["TrackDuration"].ToString());
string InsertQuery = string.Format("UPDATE tblTracks SET  TrackLength={0}, TrackDuration='{1}', TrackName='{2}',TrackDescription='{3}',TrackMap='{4}',DifficultLevel={5},OverallHeight={6},IsCircular='{7}', ForBeginners='{8}',StartPoint='{9}',ParkingPlace='{10}',SeasonOfYear={11},TrackLocation={12}, Images='{13}' WHERE UserID={14}",
                                                                      TrackLength, TrackDuration, TrackName, TrackDescription, TrackMap, DifficultID, OverallHeight, IsCircular, ForBeginners, StartPoint, ParkingPlace, SeasonID, AreaID, ImageList, UserID);

But I got this error message:

Syntax error in UPDATE statement

Syntax error (missing operator) in query expression

I realy tried to solve this, but I can't.

How can I fix this problem?

Update:

This is the value of the Query:

UPDATE tblTracks SET  TrackLength=35, TrackDuration='02:30:00', TrackName='45',TrackDescription='<p>sometext.</p>
',TrackMap='f',DifficultLevel=3,OverallHeight=450,IsCircular='true', ForBeginners='false',StartPoint='<p>?????????? </p>
',ParkingPlace='<p>????? ?????? ?????</p>
',SeasonOfYear=1,TrackLocation=3, Images='' WHERE UserID=1

The sql values types are:

TrackLength = number ; TrackDuration = date/time ; TrackName= string ;TrackDescription= string; TrackMap = string; DifficultLevel=number;OverallHeight=number;IsCircular=true/false;ForBeginners=true/false;
StartPoint=string; ParkingPlace=string; SeasonOfYear=number; TrackLocation=number;Images=string

Answer 1

'02:30:00' is not a correct value for datetime DB field, AFAIK. The default format is controlled by date format setting.

Additionally, '20130412' should work in any case, but for datetime field. You need to format the TrackDuration correctly or use CAST/CONVERT. As TimeSpan doesn't contain date part (it represents a duration and not a point in time), you can only make it up (e.g. prepend "20100101") but that is an awful hack.

The proper solution is to use the correct DB field type.

'02:30:00' might work if the field was of time type. Please read some more about time types in SQL Server.

Even better, why don't you use plain integer for the duration in seconds? The duration is not a date anyway.

The much bigger issue is that you are concatenating strings to set the command text, which opens you for SQL injection attack. If I name the racing track a';DROP TABLE tblTracks;-- your database is toast:

UPDATE tblTracks SET TrackLength=35, 
                     TrackDuration='02:30:00', 
                     TrackName='a';DROP TABLE tblTracks;-- ...