c# - How to Pick up values from datagrid ,search the database and update new values? -

i have datagrid , in have many rows. want pick 2 columns 1 row 1 column search database row value , second column update row new value. please help.

my code giving syntax error

incorrect syntax near keyword 'values'

my code

{             using (sqlconnection con = new system.data.sqlclient.sqlconnection("data source=rex;initial catalog=personaldetails;integrated security=true"))             {                 con.open();                 (int = 0; <= datagridview2.rows.count - 1; i++)                 {                     string insertdata = "update  test set availableqty = " + "values (@qty) itemcode = " + "values (@itemcode) ";                      sqlcommand cmd = new sqlcommand(insertdata, con);                    cmd.parameters.addwithvalue("@itemcode", datagridview2.rows[i].cells[0].value ?? dbnull.value);                    cmd.parameters.addwithvalue("@qty", datagridview2.rows[i].cells[4].value ?? dbnull.value);                       cmd.executenonquery();                  }             }         } 

first of all, should use parameterized queries. kind of codes open sql injection attacks.

i think misunderstand syntax of update in t-sql.

using (sqlconnection con = new system.data.sqlclient.sqlconnection("data source=rex;initial catalog=personaldetails;integrated security=true")) {        con.open();        (int = 0; <= datagridview2.rows.count - 1; i++)        {             string insertdata = "update test set availableqty = @qty itemcode = @itemcode";             sqlcommand cmd = new sqlcommand(insertdata, con);             cmd.parameters.addwithvalue("@itemcode", datagridview2.rows[i].cells[0].value ?? dbnull.value);             cmd.parameters.addwithvalue("@qty", datagridview2.rows[i].cells[4].value ?? dbnull.value);              cmd.executenonquery();          } }