Click here to Skip to main content
15,896,118 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
Is this a correct Parameterized UPDATE QUERY ? And if you find any field used
twice or is unnecessary please let me know.

---------------------------------------------------------
code
---------------------------------------------------------
VB
Private Sub btnupdate_Click(sender As Object, e As EventArgs) Handles btnupdate.Click
        Call Gender()
        Try
            con.Open()
            ss = "UPDATE emp_master set empid=@empid,empname=@empname,pfno=@pfno,dob=@dob,gender=@gender,contact=@contact,email=@email,doj=@doj," & _
                "address=@address,edu=@edu,nationality=@nationality,bloodgroup=@bloodgroup,desig=@desig,exp=@exp,salary=@salary,dept=@dept,pic=@pic,usertype=@usertype WHERE empid=" & txtempid.Text & ""
            com = New SqlCommand(ss, con)
            com.Parameters.AddWithValue("@empid", txtempid.Text)
            com.Parameters.AddWithValue("@empname", txtename.Text)
            com.Parameters.AddWithValue("@pfno", txtpfno.Text)
            com.Parameters.AddWithValue("@dob", dtpdob.Value.Date)
            com.Parameters.AddWithValue("@gender", g)
            com.Parameters.AddWithValue("@contact", txtcontact.Text)
            com.Parameters.AddWithValue("@email", txtemail.Text)
            com.Parameters.AddWithValue("@doj", dtpdoj.Value.Date)
            com.Parameters.AddWithValue("@address", txtaddress.Text)
            com.Parameters.AddWithValue("@edu", txtedu.Text)
            com.Parameters.AddWithValue("@nationality", txtNation.Text)
            com.Parameters.AddWithValue("@bloodgroup", cmb_Bloodgrp.Text)
            com.Parameters.AddWithValue("@desig", txtdesig.Text)
            com.Parameters.AddWithValue("@exp", txtexp.Text)
            com.Parameters.AddWithValue("@salary", txtsalary.Text)
            com.Parameters.AddWithValue("@dept", txtdept.Text)
            com.Parameters.AddWithValue("@pic", arrImg)
            com.Parameters.AddWithValue("@usertype", Cmb_utype.Text)
            com.ExecuteNonQuery()
            MsgBox("Record Updated Successfully !", MsgBoxStyle.Information, MsgBoxStyle.OkCancel)
        Catch ex As Exception
            MsgBox(ex.Message())
        Finally
            con.Close()
        End Try
    End Sub
Posted
Updated 4-Mar-18 20:30pm
v2

1 solution

No need to update the empid, because you are trying to select the record for that id only. Also add parameter to the where clause, no need to again take the value directly from TextBox.
 
Share this answer
 
Comments
A94 7-Mar-15 23:07pm    
But I am getting error : An object or column name is missing or empty. For SELECT INTO statements, verify each column has a name. For other statements, look for empty alias names. Aliases defined as "" or [] are not allowed. Change the alias to a valid name. Unclosed quotation mark after the character string ''.
There is only an update statement, I cannot see any select into statements. So how come you are getting this error?

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900