[sanblue]

cmd.CommandText = "UPDATE master SET appl_no='" & Me.app_id.Text & _
                        ", c_name='" & Me.app_name.Text & "'" & _
                        ", h_f_m_name='" & Me.appfm_name.Text & "'" & _
                        " WHERE appl_no=" & Me.app_id.Tag
            cmd.ExecuteNonQuery()

This post has been edited by AdamSpeight2008: 27 December 2012 - 05:35 PM

[lucky3]

You need to correct ' apostrophes in that query, and use them on both side of values. For example: appl_no='" & Me.app_id.Text & ", c_name... See there's no ' behind & ", c_name. Should be & "', c_name.

[kai_itz me]

this is the proper way for update command if u are using sql server.....empdata is my tablename... txtdata is my database...empcon my sqlconnection name.

Private Sub modify()
        empcmd.CommandText = " update txtdata.dbo.empdata set emp_code = " & txtempcode.Text & " , emp_name = '" & _
         txtempname.Text & "' , emp_sname = '" & txtempsname.Text & "' , emp_fname = '" & _
         txtempfname.Text & "' , emp_dob = '" & DateValue(txtempdob.Text).ToString("MM/dd/yyyy") & _
         "' , emp_doj ='" & DateValue(txtempdoj.Text).ToString("MM/dd/yyyy") & "' where emp_key = " & txtempkey & ""

        empcon.Open()   ' open connection
        empcmd.Connection = empcon
        empcmd.ExecuteNonQuery()  
        empcon.Close()  ' close connection

       

This post has been edited by kai_itz me: 27 December 2012 - 01:46 AM

[rgfirefly24]

you should use Parameterized statements instead of inlining your SQL. You set yourself up for risk of SQL Injection the way you currently are doing it.

EX:

com.CommandText = "UPDATE <Table> SET Col1 = @Col1, Col2 = @Col2"

com.Parameters.AddWithValue("@Col1",txtTextBox.Text)
com.Parameters.AddWithValue("@Col2",txtTextBox2.Text)