Question

What i’m trying to do is that from a ASP.NET (framework 4) a user shall be able to update an existing record in a SQL Database using the record Key. USING Visual Studio 2010 (vb)

I get an error of Syntax near ” \ “, i have 2 textboxes:
1- For the key
2-contains the information that would be sent to the SQL server in order to update such column (Control_ClosedByRev)

Dim Con As New SqlConnection
Dim SQL As String
Dim com As SqlCommand = Con.CreateCommand
Dim KeyID As Integer
KeyID = TextBox1_UpdateDataReview.Text

Con.ConnectionString = "Data Source=WCRDUSMJEMPR9\SQLEXPRESS;Initial Catalog=MicroDB;Integrated Security=True"
Con.Open()
SQL = "UPDATE ControlCharts set Control_ClosedByRev=" & TextBox2_UpdateDataReview.Text & " where ID_ControlCharts= " & KeyID
Dim cmd As New SqlCommand(SQL, Con)
'cmd.ExecuteScalar()
cmd.ExecuteNonQuery()
Label1_UpdateDataReview.Text = "Record Updated"

i tried changing the cmd.execute, it did not work. Thanks in advance.

Answer 1

First off, this is quite vulnerable to SQL Injection — read into that and use parameterized queries instead.

Here is some sample code to help.

    Con.ConnectionString = "Data Source=WCRDUSMJEMPR9\\SQLEXPRESS;Initial Catalog=MicroDB;Integrated Security=True"
    Con.Open()
    SQL = "UPDATE ControlCharts set Control_ClosedByRev=@ClosedByRev where ID_ControlCharts=@Key"

    Dim cmd As New SqlCommand(SQL, Con)
    cmd.Parameters.AddWithValue("@ClosedByRev ", TextBox2_UpdateDataReview.Text)
    cmd.Parameters.AddWithValue("@Key", KeyID)
    cmd.ExecuteNonQuery()

Good luck.