Click here to Skip to main content
Rate this: bad
good
Please Sign up or sign in to vote.
Hi how can I change this
 
str = "UPDATE tblClientes SET Nombre = @NOM WHERE NumId=@NI"
Dim comando As OleDbCommand = New OleDbCommand(str, miConeccion)
commando.Parameters.AddWithValue("@NOM", txtNombre.Text)
commando.Parameters.AddWithValue("@NI" txtNumID.Text)
 
but to use it with sql server
 

thanks
Posted 7-Mar-13 14:18pm
Comments
ThePhantomUpvoter at 7-Mar-13 19:20pm
   
Use SqlCommand instead of OleDbCommand
Joel Sosa Rivera at 7-Mar-13 19:24pm
   
Thanks

1 solution

Rate this: bad
good
Please Sign up or sign in to vote.

Solution 1

Firstly, never ever, ever, ever... write a SQL query into a string like that.
You are opening yourself up for a SQL Injection Attack if someone decides to write some code that appends to the string - read up on it if you don't know what this means.
I know in this case you are using parameters but this will not protect you if someone gets lazy in the code.
 
Use stored procedures and parameters as below:
 

Private ConnectionObj As New SqlConnection
ConnectionObj.ConnectionString = "Data Source=ServerName;Initial Catalog=DatabaseName;Integrated Security=True"
ConnectionObj.Open()
 

Dim SQLAdaptorObj As New SqlDataAdapter
Dim SqlCommandObj = New SqlCommand("a_stored_procedure", ConnectionObj)
 
SqlCommandObj.Parameters.Add("@year", SqlDbType.Int).Value = year
SqlCommandObj.Parameters.Add("@age", SqlDbType.Int).Value = age
 
SqlCommandObj.CommandType = CommandType.StoredProcedure
Dim DataTableObj As New DataTable
 

SQLAdaptorObj.SelectCommand = SqlCommandObj
SQLAdaptorObj.Fill(DataTableObj)
 

SQLAdaptorObj.Dispose()
SqlCommandObj.Dispose()
 

ConnectionObj.Close()
  Permalink  

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



Advertise | Privacy | Mobile
Web01 | 2.8.1411022.1 | Last Updated 8 Mar 2013
Copyright © CodeProject, 1999-2014
All Rights Reserved. Terms of Service
Layout: fixed | fluid

CodeProject, 503-250 Ferrand Drive Toronto Ontario, M3C 3G8 Canada +1 416-849-8900 x 100