Click here to Skip to main content
15,889,862 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
VB
Sub SaveData()
        MainForm.Cursor = Cursors.WaitCursor
        Dim SqlStr As String = ""

        'If IsOpenForAlter = True Then
        SqlStr = "UPDATE Assets SET [dbo].[AssetID]=@AssetID [AssetBarcode]=@AssetBarcode,[AssetName]=@AssetName,[AssetType]=@AssetType,[AssetDesc]=@AssetDesc,[Store]=@Store,[AssetLocation]=@AssetLocation,[Manufacture]=@Manufacture,[Brand]=@Brand,[Model]=@Model,[AssetMore]=@AssetMore,[AssetSNo]=@AssetSNo,[AssetTotal]=@AssetTotal,[Status]=@Status,[Condition]=@Condition,[AssetExpiry]=@AssetExpiry,[AssetNotes]=@AssetNotes,[PhotoPath]=@PhotoPath,[AssetVendor]=@AssetVendor,[AssetPurRate]=@AssetPurRate,[AssetScrap]=@AssetScrap,[AssetYear]=@AssetYear,[AssetPurDate]=@AssetPurDate,[AssetServiceStartDate]=@AssetServiceStartDate,[AssetWarranty]=@AssetWarranty,[AssetDepreciation]=@AssetDepreciation,[AssetDepreciationRate]=@AssetDepreciationRate, WHERE AssetName=N'" & OpenedAssetName & "'"
        'Else
        SqlStr = "INSERT INTO [dbo].[Assets] ([AssetID],[AssetBarcode],[AssetName],[AssetType],[AssetDesc],[Store],[AssetLocation],[Manufacture],[Brand],[Model],[AssetMore],[AssetSNo],[AssetTotal],[Status],[Condition],[AssetExpiry],[AssetNotes],[PhotoPath],[AssetVendor],[AssetPurRate],[AssetScrap],[AssetYear],[AssetPurDate],[AssetServiceStartDate],[AssetWarranty],[AssetDepreciation],[AssetDepreciationRate])     VALUES " _
     & " (@AssetID,@AssetBarcode,@AssetName,@AssetType,@AssetDesc,@Store,@AssetLocation,@Manufacture,@Brand,@Model,@AssetMore,@AssetSNo,@AssetTotal,@Status,@Condition,@AssetExpiry,@AssetNotes,@PhotoPath,@AssetVendor,@AssetPurRate,@AssetScrap,@AssetYear,@AssetPurDate,@AssetServiceStartDate,@AssetWarranty,@AssetDepreciation,@AssetDepreciationRate) "

        'End If
        Try
            MAINCON.ConnectionString = ConnectionStrinG
            MAINCON.Open()
            Dim DBF As New SqlClient.SqlCommand(SqlStr, MAINCON)
            With DBF.Parameters

                If Integer.TryParse(TxtAssetID.Text, id) Then
                    DBF.Parameters.AddWithValue("@AssetID", id)
                Else
                    '' The text in the textbox was not a valid integer representation.
                    '' You may have to handle that case here.
                End If
                .AddWithValue("@AssetID", Integer.Parse(TxtAssetID.Text))
                .AddWithValue("@AssetBarcode", TxtAssetBarcode.Text)
                .AddWithValue("@AssetName", TxtAssetName.Text)
                .AddWithValue("@AssetType", TxtAssetType.Text)
                .AddWithValue("@AssetDesc", TxtDescr.Text)
                .AddWithValue("@Store", TxtStoreName.Text)
                .AddWithValue("@AssetLocation", TxtLocation.Text)
                .AddWithValue("@Manufacture", TxtManufacture.Text)
                .AddWithValue("Brand", TxtBrand.Text)
                .AddWithValue("@Model", TxtModel.Text)
                .AddWithValue("@AssetMore", TxtMoreInfo.Text)
                .AddWithValue("@AssetSNo", TxtSerialNumber.Text)
                .AddWithValue("@AssetTotal", TxtQty.Text)
                .AddWithValue("@Status", TxtAssetStatus.Text)
                .AddWithValue("@Condition", txtCondition.Text)
                .AddWithValue("AssetExpiry", TxtExpiry.Value)
                .AddWithValue("@AssetNotes", TxtNote.Text)
                .AddWithValue("@PhotoPath", PhotoPathForLedgers & "\Others\" & TxtAssetName.Text & ".jpg")
                .AddWithValue("@AssetVendor", TxtVendorName.Text)
                .AddWithValue("@AssetPurRate", TxtPurRate.Text)
                .AddWithValue("@AssetScrap", TxtScrapValue.Text)
                .AddWithValue("@AssetYear", TxtYears.Text)
                .AddWithValue("@AssetPurDate", TxtpurchaseDate.Value)
                .AddWithValue("@AssetServiceStartDate", TxtServiceStartDate.Value)
                .AddWithValue("@AssetWarranty", TxtWarrantyDate.Value)
                .AddWithValue("@AssetDepreciation", TxtDepreMethod.Text)
                .AddWithValue("@AssetDepreciationRate", TxtDepRate.Text)


            End With
            DBF.ExecuteNonQuery()
            DBF = Nothing
            MAINCON.Close()
        Catch ex As Exception
            MsgBox(ex.Message)
        End Try

        Dim OpenedID As Integer = 1
        Dim cnn As SqlConnection
        cnn = New SqlConnection(ConnectionStrinG)
        cnn.Open()
        Dim ds As New DataSet()
        MainForm.Cursor = Cursors.WaitCursor


What I have tried:

i have no idea about this any one help me thanks in advance
Posted
Updated 2-Aug-18 10:31am
v2
Comments
MadMyche 2-Aug-18 14:20pm    
Help us help you; by formatting your code and placing it into a code-block. The easier it is for us to read, the easier it is to help you out
Richard Deeming 3-Aug-18 13:35pm    
".. [AssetDepreciationRate]=@AssetDepreciationRate, WHERE AssetName=N'" & OpenedAssetName & "'"


Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

You already know how to use parameters; you're doing it for literally everything else in that query. So why have you given up at the end?

Also, you have a stray comma in that query, between the last parameter and WHERE.

1 solution

Look at the error message:
Quote:
Not allowed to change the 'connectionstring' property. The connection's current state is open.
It's couldn't be any clearer: you are trying to set the ConnectionString property of a SqlConnection object that is Open. Which means that you have opened it, and somehow, somewhere, you never closed it.

Where? Dunno - could be anywhere in your code. The best solution is throw away the "global" conncetion object and create them when you need them, inside a Using Statement (Visual Basic) | Microsoft Docs[^] - that way, it is automatically Closed and Disposed when you are finished with it.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900