-1

My command is error in my sql command where clause, how can I handle it? any suggestion or any help?

This is my Error: syntax to use near 'WHERE controlNumber = '' at line 1

cmd = New Odbc.OdbcCommand("INSERT INTO alamnotice (correctivePreventive) VALUES('" & Trim(txtremarks.Text.TrimEnd()) & "') WHERE controlNumber ='" & Trim(Form1.txtcontrolNumber.Text.TrimEnd()) & "'", con)           

cmd.ExecuteNonQuery()
8
  • 2
    My command is error in my where module <--- this is totally unclear. Please change your wording, maybe that will help. What are you trying to do? Let's say you did not post any code, how would you put the question? Commented Apr 30, 2014 at 0:08
  • 1
    Disconnect what? Connect what? I think your missing a using statement or something. What error are you getting? Commented Apr 30, 2014 at 0:10
  • you should read up on SQL injection and Prepared statements using Paramters...right away...now; but what is the error - VS/VB told you more than 'error in SQL command' Commented Apr 30, 2014 at 0:11
  • just focus on my sql command, im trying to ask if my declaring where is correct. becuase thats my only problem. Commented Apr 30, 2014 at 0:14
  • 1
    SQL INSERT doesnt use a WHERE clause Commented Apr 30, 2014 at 0:37

2 Answers 2

0

You havent said what the error is, it could be something to do with Disconnect, but I suspect it is a SQL syntax error because INSERT doesnt use a WHERE (you are inserting new data).

Here is a way to use params to make the code easier to read and avoid SQL injection attacks:

Dim SQL As String = "INSERT INTO alamnotice (correctivePreventive,
             sectionInCharge, shiftInCharge, SectionHead, status, 
             dateResponded, remarksSurrendingAlarm, Remarks) 
             VALUES ("@p1", "@p2", "@p3", "@p4", "@p5", "@p6", "@p7", "@p8")"

' I am assuming OleDB, but much the same for others
'    be sure to add the values in the same order with OleDB
Using cmd As New OleDbCommand(SQL, dbCon)
  cmd.Parameters.AddWithValue("@p1", txtcorPrevAction.Text )
  cmd.Parameters.AddWithValue("@p2", txtCause.Text)
  cmd.Parameters.AddWithValue("@p3", cmbstatus.Text)
  ' etc

  cmd.ExecuteNonQuery()
End Using

for non string columns, such as a date, convert the textbox text:

cmd.Parameters.AddWithValue("@pX", COnvert.ToInt32(txtSomeValue.Text))

the code is easier to read and if you arent gluing ticks and stuff into a string, there are far fewer string format errors like a missing '

Sign up to request clarification or add additional context in comments.

Comments

0

try this one :

UPDATE alamnotice SET correctivePreventive = '" & Trim(txtremarks.Text.TrimEnd()) & "'  WHERE controlNumber ='" & Trim(Form1.txtcontrolNumber.Text.TrimEnd()) & "'"

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.