If roll is a string type, I don't think your query will work, unless you place single quotes around the values. In addition, one way to improve your code is to use parameters. See below for example.
str = "UPDATE Table1 SET roll=@rollVal1 WHERE roll=@rollVal2"
cmd = New Sqlommand(str, cn)
cmd.Parameters.AddWithValue("@rollVal1", TextBox1.Text)
cmd.Parameters.AddWithValue("@rollVal2", sl)
cmd.ExecuteNonQuery()
[Edit]
See
here[
^] for reference.