Click here to Skip to main content
15,888,287 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Hello anybody can help me I want to update data but this error show.
Posted
Updated 16-Oct-12 1:15am
v2
Comments
OriginalGriff 16-Oct-12 5:54am    
Answer updated
AshishChaudha 16-Oct-12 7:21am    
please provide us the code..how could we know where the error is coming without the code.

1 solution

We would need to know where the error is being reported, but first, please do no do it like that: it is an invitation to damage or destruction of your database. Do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.
str = "Update bxs_tbl set SldID = @SID, DateReport = @DR" where BxsNo = @BXNO
cmd.Connection = cn
cmd.CommandType = CommandType.Text
cmd.CommandText = str
cmd.Parameters.AddWithValue("@SID", txtSLD_ID.Text)
cmd.Parameters.AddWithValue("@DR", dtpReport.Value)
cmd.Parameters.AddWithValue("@BXNO", txtbxsno.Text)
And so on.

It may also solve your problem...or at least make it easier to see.



"I populated this form from listview of another form and it work well. The error occured when I click the update button I'm a beginner in vb.net"

It may "work well" - or appear to, but the fact remains that I could delete your database just but typing into a text box and pressing the "update" button. That is what an SQl Injection Attack is all about. If you are using this type of code in other places, then they are at risk as well. Google for "bobby tables" if you don't believe me, and trust me on this - your best mate will try this "for a laugh" on your database if you give him a chance.
 
Share this answer
 
v2
Comments
Dastan44 16-Oct-12 7:53am    
Thanks man, I'm not aware of "bobby tables before. anyway I deleted the code.
Dastan44 16-Oct-12 7:55am    
I've tried your suggestion but now i have this error "Must declare the scalar variable "@ID".
OriginalGriff 16-Oct-12 11:55am    
Sorry for the delay - my hosting service is having problems and emails are taking hours to get through!
You have probably solved this by now, but if you haven't, then check your parameter names: Somewhere you have "@ID" in the SQL statement, and not in the AddWithValue list.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900