Question

I have been struggling with this problem for a couple days, and have not been able to find out what is wrong with the following code. When I click a button to update, nothing gets updated. By the way, I am using an html table to display a customer’s information, and then using those textboxes in the table to update the fields. But the SQL Update Statement just isn’t working. Here is the code:

Protected Sub btnUpdate_Click(sender As Object, e As System.EventArgs) Handles btnUpdate.Click

    Dim myConnection As OleDbConnection 

    Dim myCommand As OleDbCommand  

    Dim ID As Integer 

    Dim mySQLString As String, strFirstName As String, strLastName As String, strPhone As String, strEmail, strComment As String, Employee As String, DateCalled, TimeCalled, DateEdited As datetime 

    myConnection = New OleDbConnection("Provider=Microsoft.Jet.OLEDB.4.0;Data Source=\wfccdb\datagridview\app_data\t3corp.mdb;")  

    myConnection.Open()  

    ID = Request.QueryString.Item("r") 

    Employee = tbEMP.Text  

    strFirstName = tbFname.Text

    strLastName = tbLname.Text

    strPhone = tbPhone.Text 

    strEmail = tbEmail.Text 

    DateCalled = Convert.ToDateTime(tbDateCalled.Text)  
    TimeCalled = Convert.ToDateTime(tbTimeCalled.Text)  
    strComment = tbComment.Text  
    DateEdited = Now

    mySQLString = "UPDATE customers SET Employee='" + Employee + "', FirstName='" + strFirstName + "', LastName='" + strLastName + "', Phone='" + strPhone + "', Email='" + strEmail + "', DateCalled='" + DateCalled + "', " + _
    "TimeCalled='" + TimeCalled + "', Comment='" + strComment + "', DateEdited='" + DateEdited + "' WHERE ReferenceID=" & Val(ID) & "" 

    myCommand = New OleDbCommand  

    myCommand.Connection = myConnection

    myCommand.CommandText = mySQLString

    myCommand.ExecuteNonQuery()
    myConnection.Close()



    Response.Redirect("ViewEditRecords.aspx?r=" + Request.QueryString.Item("r"))


End Sub 

Answer 1

your update SQL string contains a few problems. Let’s start from the beginning.

mySQLString = "UPDATE customers SET Employee='" + Employee + "', FirstName='" + strFirstName + "', LastName='" + strLastName + "', Phone='" + strPhone + "', Email='" + strEmail + "', DateCalled='" + DateCalled + "', " + _
"TimeCalled='" + TimeCalled + "', Comment='" + strComment + "', DateEdited='" + DateEdited + "' WHERE ReferenceID=" & Val(ID) & "" 

First of all, notice the three date/time values you are trying to assign DateCalled, TimeCalled, DateEdited. I assume that they are real date values in your Access table. In this case you need to construct the update statement for the column as follows:

".... DateCalled=#" + tbDateCalled.Text + "# ...."

(you need to surround the date value with #). Do this for TimeCalled as well.

Now, have a look at your "' WHERE ReferenceID=" & Val(ID) & "". If you check what VAL function does, it is doing an opposite: converting string to number. So, in your case, you need to use (drop & "" as well, as there is no need for it):

"' WHERE ReferenceID=" & CStr(ID)

And finally, why don’t you check the error string after you call myCommand.ExecuteNonQuery(). I am pretty sure Access would tell you what the errors are

So, to incorporate the suggestions from sgeddes, your final SQL string should look like this:

Employee = Replace(Employee, "''", "'")
Employee = Replace(Employee, "'", "''")
Do this for first name, last name, phone, comment and email to minimise the threat of SQL injections

mySQLString = "UPDATE customers SET Employee='" & Employee & "', FirstName='" & strFirstName & "', LastName='" & strLastName & "', Phone='" & strPhone & "', Email='" & strEmail & "', DateCalled=#" & tbDateCalled.Text & "#, " + _
"TimeCalled=#" & tbTimeCalled.Text & "#, Comment='" & strComment & "', DateEdited=Now() WHERE ReferenceID=" & CStr(ID)