update sql

[Mike Bishop]

anyone help with this?

I have a unique id on each line of sql, i want to be able to update a row from a table i tested and tested this but unable to get this working. does anyone know how i am able to do this?

Dim PINV As String
    PINV = Me.txtPassword.Text

       Dim con As New SqlConnection
        Dim cmd As New SqlCommand
        Try
            con.ConnectionString = "Data Source=10.10.0.25;Initial Catalog=RConditions;Persist Security Info=True;User ID=mbish;Password=mbish"
            con.Open()
            cmd.Connection = con
            cmd.CommandText = "update Settings SET pin =" & PINV & "where Company = '1')"
 
            cmd.ExecuteNonQuery()
        Catch ex As Exception
            MessageBox.Show("Error while inserting record on table..." & ex.Message, "Insert Records")
        Finally
            con.Close()
        End Try

        MsgBox("Pin Saved")

    
    End Sub

cmd.CommandText = "update Settings SET pin = '" & PINV & "' where Company = '1')"

You should really use parameters:

cmd.CommandText = "update Settings SET pin = @Pinv where Company = @Company)"
        cmd.Parameters.AddWithValue("@Pinv", PINV)
        cmd.Parameters.AddWithValue("@Company", 1)

[Mike Bishop]

sorry this still not working thanks for your help.

Dim PINV As String
       

        PINV = txtSysPassword.Text


        Dim con As New SqlConnection
        Dim cmd As New SqlCommand
        Try
            con.ConnectionString = "Data Source=10.10.0.25;Initial Catalog=RConditions;Persist Security Info=True;User ID=mbish;Password=mbish"
            con.Open()
            cmd.Connection = con
            cmd.CommandText = "update Settings SET pin = @PinV where Company = @Company)"
            cmd.Parameters.AddWithValue("@PinV", PINV)
            cmd.Parameters.AddWithValue("@Company", 1)
 
            cmd.ExecuteNonQuery()
        Catch ex As Exception
            MessageBox.Show("Error while inserting record on table..." & ex.Message, "Insert Records")
        Finally
            con.Close()
        End Try

        MsgBox("Pin Saved")

Heres an example of why to use parameters.

If you set the PINV string to

PINV = "anything' where 1 = 1 ----"

would update every record in the table to anything if you used the following CommandText:

cmd.CommandText = "update Settings SET pin = '" & PINV & "' where Company = '1')"

Get rid of the ) at the end of your sql statement

[Mike Bishop]

thanks very much for your help.

this is now working

Sorry about the )

I must have hit a key before copying it.

[nemzmiyaw]

Thanks for this thread, i convert it to Mysql and it works like a charm ^_^