Click here to Skip to main content
15,911,789 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
HI,

i have successfully connected ms access database it working fine but

1. when edit & save something in richtextbox1 it's says Update done but when i go to Ms access database which is not saved (what i am edit or typed)

What I have tried:

Provider = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source="
        dataFile = "F:\Praise\Praise\bin\Debug\Database.accdb"
        connString = Provider & dataFile
        myConnection.ConnectionString = connString
        myConnection.Open()
        Dim str As String
        str = "Update [SONGS] set [SONG_ETITLE] = '" & TextBox2.Text & "',[SONG_TTITLE] = '" & TextBox3.Text & "',[SONG_SONGS1] ='" & RichTextBox1.Text & "',[SONG_SONGL2]='" & RichTextBox1.Text & "' Where [CODE]=" & TextBox1.Text & ""
        Dim cmd As OleDbCommand = New OleDbCommand(str, myConnection)


        Try

            cmd.ExecuteNonQuery()
            cmd.Dispose()
            myConnection.Close()
            MessageBox.Show("Update Done")
            TextBox1.Enabled = False
            TextBox2.Enabled = False
            TextBox3.Enabled = False
            RichTextBox1.Enabled = False

        Catch ex As Exception


        End Try
    End Sub
Posted
Updated 8-Jan-20 3:10am

Don't do it like that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
SQL
DROP TABLE MyTable;
A perfectly valid "delete the table" command
SQL
--'
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

And don't "swallow" exceptions - you throw away not only any sign that something went wrong, but all the information that you need to fix it. Display it, log it, whatever - but just swallowing it as if it didn't matter is a very poor idea.

Once you've fixed all that throughout your whole application - and miss one and somebody will find it and delete your DB - and you may find your problem is gone as well.
 
Share this answer
 
Comments
Member 14621280 27-Dec-19 12:26pm    
I am very new to Vb.net can u suggest me along with code?
Member 14621280 27-Dec-19 12:26pm    
Because i can't understand what you are said
OriginalGriff 27-Dec-19 12:36pm    
"Concatenating strings" is the "proper" term for "adding strings together to make a bigger string" and it's very, very dangerous when you start talking to databases because you hand complete control of your DB to the user. He can do anything he likes just by typing into your text boxes because the string concatenation you use lets him. And everybody who knows anything about databases knows that - to the point where the first UK census that you could submit online got complaints because it was written properly and wasn't susceptible to SQL Injection, and it was felt that government programmers shouldn't know about that stuff! Parameterised queries prevent that:
                Using con As New SqlConnection(strConnect)
                	con.Open()
                	Using com As New SqlCommand("INSERT INTO myTable (myColumn1, myColumn2) VALUES (@C1, @C2)", con)
                		com.Parameters.AddWithValue("@C1", myValueForColumn1)
                		com.Parameters.AddWithValue("@C2", myValueForColumn2)
                		com.ExecuteNonQuery()
                	End Using
                End Using
Member 14621280 7-Jan-20 1:27am    
Using con As New SqlConnection(strConnect)
con.Open()
Using com As New SqlCommand("INSERT INTO SONGS (SONG_ETITLE, SONG_TITLE) VALUES (@SONG_SONGS1, @SONG_SONGS2)", con)
com.Parameters.AddWithValue("@SONG_SONGS1", RichTextBox1.Text)
com.Parameters.AddWithValue("@SONG_SONGS2", RicTextBox1.Text)
com.ExecuteNonQuery()
End Using


Is this correct?
OriginalGriff 7-Jan-20 2:20am    
Two things:
1) Why are you inserting the same text twice? (Assuming "RicTextBox1.Text" is a mistype of "RichTextBox1.Text".)
2) Stop using all uppercase: use CamelCase for your fields and tables, and don;t prefix your fields with the table name (you may need to do that for real later, and then you end up with SONGS.SONG_TITLE which starts to get silly and very redundant).
INSERT INTO Songs (ETitle, Title) VALUES (@ETITLE, @TITLE)
VB
str = "Update [SONGS] set [SONG_ETITLE] = '" & TextBox2.Text & "',[SONG_TTITLE] = '" & TextBox3.Text & "',[SONG_SONGS1] ='" & RichTextBox1.Text & "',[SONG_SONGL2]='" & RichTextBox1.Text & "' Where [CODE]=" & TextBox1.Text & ""

Not necessary a solution to your question, but another problem you have.
Never build an SQL query by concatenating strings. Sooner or later, you will do it with user inputs, and this opens door to a vulnerability named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input a name like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability, and the crash is the least of the problems, a malicious user input and it is promoted to SQL commands with all credentials.
SQL injection - Wikipedia[^]
SQL Injection[^]
SQL Injection Attacks by Example[^]
PHP: SQL Injection - Manual[^]
SQL Injection Prevention Cheat Sheet - OWASP[^]
How can I explain SQL injection without technical jargon? - Information Security Stack Exchange[^]
 
Share this answer
 
Comments
Member 14621280 7-Jan-20 1:21am    
So what should i do this?

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900