Incorrect Syntax Near - Unclosed Quotation Mark After The Character String

[juhii3102]

protected void btn_Edit_Click(object sender, EventArgs e)
    {
        Panel1.Visible = true;
        Button5.Visible = true;
        if (FileUpload1.HasFile)
        {
            //string filename = Path.GetFileName(FileUpload1.PostedFile.FileName);
            //FileUpload1.SaveAs(Server.MapPath(filename));
            string filename = "~/Uploads/" + FileUpload1.FileName;
            FileUpload1.SaveAs(Server.MapPath(filename));

            conn.Open();
            if (TextBox10.Text != "")
            {
                SqlCommand cmd = new SqlCommand("UPDATE Question_tbl SET ExamName='" + ddl_ExamName.Text + "',SubjectName='" + ddl_SubjectName.Text + "',TopicName='" + ddl_TopicName.Text + "',QuestionLevel='" + ddl_QuestionLevel.Text + "',QuestionMmarking='" + tb_QMarking.Text + "',QuestionType='" + ddl_QType.Text + "',Question='" + tb_Question.Text + "',Option1='" + tb_Option1.Text + "',Option2='" + tb_Option2.Text + "',Option3='" + tb_Option3.Text + "',Option4='" + tb_Option4.Text + "',CorrectOption='" + tb_CorrectOption.Text + "',Solution='" + tb_Solution.Text + "',AImage='" + filename + "' where QuestionId='" + TextBox10.Text + "'", conn);
                cmd.ExecuteNonQuery();
                Page.Response.Redirect(HttpContext.Current.Request.Url.ToString(), true);
                Response.Write("Sucessfully updated..");

            }
            ClearText();
            conn.Close();
        }
    }

here is my code and it is giving this error.."Incorre ct Syntax Near s - Unclosed Quotation Mark After The Character String"

please help in solving this problem its urjent...

[Rabbit]

Please use code tags when posting code.

The most likely cause is that one of your variables has a quote in its value. You need to either parameterize your query or escape the quotes. Otherwise you open yourself up to these errors and SQL injection attacks.

[donbock]

Is this a compile-time error or is perhaps a run-time error generated by SQL?