Question

I am using MS Access Database. Now I have to update a particular cell value. Here is my code:

Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click

Dim str As String
Dim Presc As New System.Text.StringBuilder
Dim prs As String(), j As Integer
prs = Split(txtPrescription.Text, vbCrLf)
For j = 0 To prs.Length - 1
    Presc.Append(prs(j))
    Presc.Append(",")
Next
Try
    str = Trim(lsvCase.SelectedItems(0).Text)
    'MessageBox.Show(str)
    Dim con As System.Data.OleDb.OleDbConnection
    Dim ds As New DataSet
    Dim rea As System.Data.OleDb.OleDbDataReader
    con = New OleDb.OleDbConnection
    Dim da As New System.Data.OleDb.OleDbDataAdapter
    con.ConnectionString = "Provider = Microsoft.ACE.OLEDB.12.0; Data Source= F:\Sowmya Laptop Backups\sowdb1.accdb;"
    con.Open()
    Dim cmd As OleDb.OleDbCommand = con.CreateCommand
    cmd.CommandText = "UPDATE Casehistory set Prescription =' " & Presc.ToString() & "'"
    rea = cmd.ExecuteReader
    cmd.ExecuteNonQuery()
    da.FillSchema(ds, SchemaType.Mapped)
    da.Update(ds, "Casehistory")
    con.Close()
Catch ex As Exception
Finally
End Try
End Sub

This code updates all the cells in that column. I want to update only the particular cell having Case_ID = str
Where I have to add the WHERE clause (WHERE Case_ID = ” & str & “

Answer 1

I would use command parameters, neater and prevents the SQL injection issue. Something like:

cmd.CommandText = "UPDATE Casehistory set Prescription =@Presc WHERE Case_ID = @CaseID"
cmd.Parameters.AddWithValue("@Presc", Presc.ToString())
cmd.Parameters.AddWithValue("@CaseID",str)

As an aside, having all this code in the button click event is less than ideal. You might want to investigate structuring your app in a more maintainable way – perhaps with a Data Layer for example.