Click here to Skip to main content
15,880,469 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I am a having a change passwrod form where I need to update password with verifying UID and Designation or type, But I am getting error "Syntax error in update statement", below i scode snapshot:

VB
Try

    adp = New OleDbDataAdapter("select * from Login", con)
    dt.Clear()
    adp.Fill(dt, "Login")
    str = "Update Login set Password='" + txtNpassword.Text + "' where Type='" + cbDesignation.Text + "' and UserId='" + txtuname.Text + "'"
    cmd = New OleDbCommand(str, con)
    Dim i As Integer
    For i = 0 To dt.Tables(0).Rows.Count - 1
        If (cbDesignation.Text = dt.Tables(0).Rows(i).Item(1) And txtuname.Text = dt.Tables(0).Rows(i).Item(2)) Then
            UID = True
            Exit For
            
        End If
    Next
    If UID = True Then
        con.Open()
        cmd.ExecuteNonQuery()
        MsgBox("Password Changed successfully", MsgBoxStyle.Information)
    Else
        MsgBox("Password Not changed", MsgBoxStyle.Information)

    End If


Catch ex As Exception
    MessageBox.Show(ex.Message)

Finally
    If (con.State = ConnectionState.Open) Then
        con.Close()

    End If
    UID = False

End Try
Posted
v2

Two major no-nos appear here:
1) Do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.
2) Never store passwords in clear text - it is a major security risk. There is some information on how to do it here: Password Storage: How to do it.[^]

If you fix those two, there is a good chance that your syntax error will disappear at the same time.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900