How Can I Update A Record

Question

1.00/5 (1 vote)

See more:

Hello guys,
i just want to update only one record in a table without using where statement
i think i can do that by call recordset
this my code:

VB

Dim cs As String = ("Provider=Microsoft.ace.OLEDB.12.0; Data Source=" & Application.StartupPath & "\vbdata.accdb")
con = New OleDbConnection(cs)
con.Open()
Dim cb As String = ("update tblmoney set [amount] = '" & txt1.Text & "' , [aname] = '" & txt2.Text & "' ")
Dim cmd As New OleDbCommand(cb)
cmd.Connection = con
cmd.ExecuteReader()
con.Close()

Posted 24-Feb-15 8:51am

Bass Alfan

Add a Solution

Comments

[no name] 24-Feb-15 15:00pm

First of all use Parameters instead of concatenating SQL - commands.
And after that I'm not safe in this stuff, but I think you should call cmd.ExecuteNonQuery() instead of ExecuteReader....Try it, maybe it helps :)

Bass Alfan 24-Feb-15 15:23pm

how can i use Parameters?!!
can you please describe that by code?

[no name] 24-Feb-15 15:36pm

Have a look to example inhttps://msdn.microsoft.com/en-us/library/system.data.oledb.oledbcommand.parameters(v=vs.110).aspx[^].

BTW did you tried ExecuteNonQuery instead ExecuteReader?

Sergey Alexandrovich Kryukov 24-Feb-15 15:42pm

Good points; I answered on SQL injection crediting your comments, please see Solution 1.
I also added more specific MSDN link more specifically explaining how to prevent this exploit.
—SA

[no name] 24-Feb-15 15:46pm

Thank you, I also allready voted a 5 :)
Bruno

Sergey Alexandrovich Kryukov 24-Feb-15 15:47pm

Thank you, Bruno.
—SA

[no name] 24-Feb-15 16:17pm

And after reading your question again: Updating _one_ record without WHERE Statement is only possible in case the table has only one record :)

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Sergey Alexandrovich Kryukov · Answer 1 · 2015-02-24T09:40:00

Bruno Sprecher is right: your approach is wrong from the very beginning. The query composed by concatenation with strings taken from UI. Not only repeated string concatenation is inefficient (because strings are immutable; do I have to explain why it makes repeated concatenation bad?), but there is way more important issue: it opens the doors to a well-known exploit called SQL injection.

This is how it works: http://xkcd.com/327[^].

What to do? Just read about this problem and the main remedy: parametrized statements: http://en.wikipedia.org/wiki/SQL_injection[^].

With ADO.NET, use this: http://msdn.microsoft.com/en-us/library/ff648339.aspx[^].

Please see my past answers for some more detail:
EROR IN UPATE in com.ExecuteNonQuery();[^],
hi name is not displaying in name?[^].

—SA