Then do:
Dim query As String = "UPDATE cg_security_user_right SET user_id, right_id ,enable_flag WHERE LastName = @param1 AND right_id = @param2 AND enable_flag = @param3"
Dim conn As New SqlConnection("connString")
Dim cmd As SqlComamnd = New SqlCommand(query, conn)
cmd.Parameters.Add("@param1", SqlDbType.VarChar, 50).Value = tuser.Text
cmd.Parameters.Add("@param2", SqlDbType.Int).Value = Integer.Parse(tright.Text)
'check if its not an integer, if its string, do as in line before
cmd.Parameters.Add("@param3", SqlDbType.Bit).Value = If(CheckBox1.Checked, 1, 0)
cmd.ExecuteNonQuery()