Update Statement Syntax Error with Access Database in C# / OledB

Question

I am trying to update data/a record on an Access 2010 Database through C# using an OledB connection and trying to make an application that is able to insert, update, delete data with the database. So far I can insert into the database okay and use a ComboBox to select a record but as of yet isn't updating.

It comes up with the following error:

An unhandled exception of type 'System.Data.OleDb.OleDbException' occurred in ClassLibrary2.dll

Additional information: Syntax error in UPDATE statement.

Note: I have tried using squared brackets but didnt change much and came up with a fatal error instead

Here is the code:

using System;
using System.Collections.Generic;
using System.Data.OleDb;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using ClassLibrary;
using System.Data;

namespace ClassLibrary2
{
    public class Class1
    {
        OleDbConnection connection;
        OleDbCommand command;

        private void ConnectTo()
        {
            connection = new OleDbConnection(@"Provider=Microsoft.ACE.OLEDB.12.0;Data Source=F:\CMS\CustomerDatabase.accdb;Persist Security Info=False");
            command = connection.CreateCommand();
        }
        public Class1()
        {
            ConnectTo();
        }

        public void Insert(Customer p)
        {
            try
            {
                command.CommandText = "INSERT INTO CustomerData ([Forename], [Surname], [Email Address], [Home Phone Number], [Mobile Phone Number], [Address], [AreaTown], [County], [Postcode]) VALUES('" + p.Forename1 + "', '" + p.Surname1 + "', '" + p.EAddress1 + "', '" + p.HomePhone1 + "' , '" + p.MobNum1 + "' , '" + p.Address1 + "', '" + p.AreaTown1 + "', '" + p.County1 + "', '" + p.Postcode1 + "')";
                command.CommandType = CommandType.Text;
                connection.Open();

                command.ExecuteNonQuery();
            }
            catch (Exception)
            {
                throw;
            }
            finally
            {
                if (connection != null)
                {
                    connection.Close();
                }
            }
        }

        public List<Customer> FillComboBox()
        {
            List<Customer> CustomersList = new List<Customer>();
            try
            {
                command.CommandText = "SELECT * FROM CustomerData";
                command.CommandType = CommandType.Text;
                connection.Open();

                OleDbDataReader reader = command.ExecuteReader();

                while (reader.Read())
                {
                    Customer p = new Customer();

                    p.Id = Convert.ToInt32(reader["ID"].ToString());
                    p.Forename1 = reader["Forename"].ToString();
                    p.Surname1 = reader["Surname"].ToString();
                    p.EAddress1 = reader["Email Address"].ToString();
                    p.HomePhone1 = reader["Home Phone Number"].ToString();
                    p.MobNum1 = reader["Mobile Phone Number"].ToString();
                    p.Address1 = reader["Address"].ToString();
                    p.AreaTown1 = reader["AreaTown"].ToString();
                    p.County1 = reader["County"].ToString();
                    p.Postcode1 = reader["Postcode"].ToString();

                    CustomersList.Add(p);
                }
                return CustomersList;
            }
            catch (Exception)
            {
                throw;
            }
            finally
            {
                if (connection != null)
                {
                    connection.Close();
                }
            }
        }

        public void Update(Customer oldCustomer, Customer newCustomer)
        {
            try
            {
                command.CommandText = "UPDATE CustomerData SET Forename= '" + newCustomer.Forename1 + "', Surname= '" + newCustomer.Surname1 + "', Email Address= '" + newCustomer.EAddress1 + "', Home Phone Number= '" + newCustomer.HomePhone1 + "', Mobile Phone Number= '" + newCustomer.MobNum1 + "', Address= '" + newCustomer.Address1 + "', AreaTown= '" + newCustomer.AreaTown1 + "', County= '" + newCustomer.County1 + "', Postcode= '" + newCustomer.Postcode1 + "'  WHERE ID= ' + oldCustomer.Id'";
                command.CommandType = CommandType.Text;
                connection.Open();

                command.ExecuteNonQuery();
            }
            catch (Exception)
            {
                throw;
            }
            finally
            {
                if (connection != null)
                {
                    connection.Close();
                }
            }
        }
    }
}

Sorry if the code is a bit long

I've only just started using C# so may need a bit more explaining

Don't mind giving any further details so feel free to ask

Answer 1

Encapsulate column names with spaces in them with square brackets, similar to how you did it in the INSERT statement.

..., [Home Phone Number] = '" + newCustomer.HomePhone1 + "', ...

Also, look into parameterizing your queries. It's safer and far easier to maintain.

..., [Home Phone Number] = @HomePhoneNumber, ...

command.Parameters.AddWithValue("@HomePhoneNumber", newCustomer.HomePhone1);

Avoid spaces in column names where you can, too. You can just as easily use underscores, and then you don't have to remember to surround them with brackets everywhere you reference them.