Since your field names have spaces in them you need to put them in brackets. []
UPDATE Students SET [last name] = ...
However, there is a huge security problem with doing code this way. You need to add the value in as a parameterized query instead. I would suggest you read up on Sql Injections.