送新人,为什么不推荐这样写,这样写有啥问题
如下代码

　　C# code

　　protected void GridView1_RowUpdating(object sender, GridViewUpdateEventArgs e) { string sqlstr = "update Patients set P_Name='" // + ((TextBox)(GridView1.Rows[e.RowIndex].Cells[1].Controls[0])).Text.ToString().Trim() + "',ID_Card='" + ((TextBox)(GridView1.Rows[e.RowIndex].Cells[3].Controls[0])).Text.ToString().Trim() + "',Guardian_Name='" + ((TextBox)(GridView1.Rows[e.RowIndex].Cells[4].Controls[0])).Text.ToString().Trim() + "' where PatientID='" + GridView1.DataKeys[e.RowIndex].Value.ToString() + "'"; sqlHp.SQLExecute(sqlstr); GridView1.EditIndex = -1; bind(); }

为什么不推荐这样写,这样写有啥问题