Groups | Blog | Home
all groups > dotnet academic > july 2003 >

dotnet academic : Using variables in query?


Justin
7/14/2003 3:24:08 AM
The code below can't seems to work. Can you please tell me
how i can refer a query to a value gave by the users to
find the specific row of data to be modified


Dim intID As integer = tbID.Text
Dim strPassword as string = tbPass.text

MyComponent2.OleDbUpdateCommand1.CommandText
= " UPDATE UserDetails " & _
" SET Password = strPassword WHERE ID = intID"

MyComponent2.OleDbConnection1.Open()
MyComponent2.OleDbUpdateCommand1.ExecuteNonQuery()
Rajesh
7/14/2003 5:14:39 AM
Hi Justin,
Since command text is a string. you should write it as
UPDATE UserDetails " & _
[quoted text, click to view]
=" & intID

Rajesh



[quoted text, click to view]
Peter van der Goes
7/14/2003 6:44:17 AM

[quoted text, click to view]

Although you don't provide the error message received when this code
executes, I'll have a go at the possible problem. Password is a string field
and you need to put the variable name in single quotes to indicate the
content type in your SQL query - SET Password = 'strPassword'. In the case
of the value for ID (intID), such punctuation is not needed because the
value is numeric.
Again, this is a guess based on info provided.


Peter van der Goes
7/14/2003 7:26:20 AM

[quoted text, click to view]
Right! I only addressed the need for the single quotes around strPassword,
and Rajesh finished the job. The whole query must be in double quotes.

Tom
7/14/2003 9:15:18 AM
Also, to protect against SQL injection attacks, we escape
single quotes in the real world. Just a tip that's nice
to know.
[quoted text, click to view]
AddThis Social Bookmark Button