Displaying the values of listview in textboxes

I'm creating an application in Visual Studio 2010 C# and MySQL where the user can add, edit, view an employee. I already done with adding and viewing part. However I'm little confused in editing. I have this listView in my form where it displays all the employee added to the database. What I want is that whenever the user will select an employee and click edit button I want the values saved in the database to show in the corresponding textboxes below the listView. Can someone give me any idea how to do this? Please

Screenshot:

Code for listView:

private void getEmployee()
    {
        listViewEmployee.Items.Clear();
        string cmd = "select employee_number, employee_lastname, employee_firstname, employee_middlename, employee_position, employee_datehired from employee";
        DBConn db = new DBConn();
        DataTable tbl = db.retrieveRecord(cmd);
        foreach (DataRow row in tbl.Rows)
        {
            ListViewItem lv = new ListViewItem(row[0].ToString());
            lv.SubItems.Add(row[1].ToString() + ", " + row[2].ToString() + " " + row[3].ToString());
            lv.SubItems.Add(row[4].ToString());
            lv.SubItems.Add(row[5].ToString());
            listViewEmployee.Items.Add(lv);
        }
    }

    private void textBoxSearchEmployee_TextChanged(object sender, EventArgs e)
    {
        string cmd = "SELECT employee_number, employee_lastname, employee_firstname, employee_middlename, employee_position, employee_datehired FROM employee where employee_lastname Like '" 开发者_运维知识库+ textBoxSearchEmployee.Text + "%'";
        listViewEmployee.Items.Clear();
        DBConn db = new DBConn();
        DataTable tbl = db.retrieveRecord(cmd);
        foreach (DataRow row in tbl.Rows)
        {
            ListViewItem lv = new ListViewItem(row[0].ToString());
            lv.SubItems.Add(row[1].ToString() + ", " + row[2].ToString() + " " + row[3].ToString());
            lv.SubItems.Add(row[4].ToString());
            lv.SubItems.Add(row[5].ToString());
            listViewEmployee.Items.Add(lv);
        }
    }

It seems to me you are able to populate the listView only.

A few pointers:

1) The way you're writing your SQL statement now is prone to SQL Injection. Use parameters in your SQL commands instead of directly concatenating the variables to your query. See this question for an example on how to do it.

2) Depending on where your other relevant data is located (i.e. if your database is normalized), you might have to do a join in your query.

string sqlQuery = "SELECT * FROM employee 
JOIN other_employee_data_table on other_employee_data_table.employeeID = employee.ID
WHERE employee.employee_lastname LIKE @employee_lastname +'%'"

But if your employee table contains all the data, then no need to do a join. Just get all the relevant information from that table.

3) Once you got all the information you need, it's just a matter of reading those data and assigning them to their respective fields.

Pseudo Code:

using (MySqlConnection connection = new MySqlConnection(connectionString))
{
   connection.Open(); 
   MySqlCommand command = connection.CreateCommand();
   command.CommandText = sqlQuery;
   command.CommandType = System.Data.CommandType.Text;
   // add parameters in this line
   using (MySqlDataReader reader = command.ExecuteReader())
   {  
      while (reader.Read()) 
      {     
         // iterate in each row
         for (int i = 0; i < reader.FieldCount; i++)
         {
            // iterate each column using reader.GetValue(i)
         }
      }
   }
}

When the user presses the "edit" button...

1. Retrieve the selected employee
2. Use a SELECT to get the selected employee's information
3. Populate the text boxes with the selected employee's information

For example,

String employee = listViewEmployee.Text;
String cmd = "SELECT * FROM employee WHERE employee_lastname='" + employee + "'";
DBConn db = new DBConn();
DataTable tbl = db.retrieveRecord(cmd);
txtLastName.Text = tbl.Rows[0][0];
// ... 
// etc.

Note: It's a bad idea to concatenate values into a SQL query because if the values are malicious, a different query could be executed. For example, if employee had the value of x' OR '1'='1; DROP TABLE employee; -- or something along those lines, then the employee table could be dropped. The way around this is using Stored Procedures or parameterized queries.