sql update命令的vb.net问题

Question

I'm looking for some help trying to figure out why I'm seeing a SQL error on an update command within vb.net, noting that my SQL experience is very limited.

I'm in the midst of building a profile system that will be used in several other tools within our company, as part of the profile system, the user's information is queried against our LDAP directory upon page load and the data stored in variables displayed in labels on the page.

The user then has the option to create a new profile if one does not exist, or update an existing if there is already one in place. The code determines the proper action based on a query to the table using the users employee id.

My insert command works ok but the update does not, below is my current code and the error.

This is the insert statement to create a new entry, this works properly.

    Protected Sub btnInsert_Click(sender As Object, e As EventArgs) Handles btnInsert.Click
    Try
        Dim con As New SqlConnection
        Dim cmd As New SqlCommand

        con.ConnectionString = "Data Source="server" Catalog=usertable;Integrated Security=True"

        con.Open()
        cmd.Connection = con

        cmd.CommandText = "INSERT INTO Profile (FirstName, LastName, Email, Telephone, EmployeeID, NTLogin) VALUES ('" & lblFirstName.Text & "','" & lblLastName.Text & "','" & lblEmail.Text & "','" & lblPhone.Text & "','" & lblEID.Text & "','" & lblNT.Text & "')"

        cmd.ExecuteNonQuery()
        btnInsert.Enabled = False
        lblValid.Text = "Record Inserted Successfully"
        con.Close()
    Catch ex As System.Exception
        lblValid.Text = (ex.Message)

    End Try

The following is the update code that gives an error:

Protected Sub btnUpdate_Click(sender As Object, e As EventArgs) Handles btnUpdate.Click
    Try
        Dim con As New SqlConnection
        Dim cmd As New SqlCommand

        con.ConnectionString = "server;Initial Catalog=usertable;Integrated Security=True"
        con.Open()
        cmd.Connection = con

        cmd.CommandText = "UPDATE Profile (FirstName, LastName, Email, Telephone, EmployeeID, NTLogin) VALUES ('" & lblFirstName.Text & "','" & lblLastName.Text & "','" & lblEmail.Text & "','" & lblPhone.Text & "','" & lblEID.Text & "','" & lblNT.Text & "') Where [EmployeeID] = '" & lblEID.text & "'"

        cmd.ExecuteNonQuery()
        btnUpdate.Enabled = False
        lblValid.Text = "Record Updated Successfully"
        con.Close()
    Catch ex As System.Exception
        lblValid.Text = (ex.Message)
    End Try
End Sub

The exception error returned is

    [SqlException (0x80131904): Incorrect syntax near '('.]
   System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection, Action`1 wrapCloseInAction) +392
   System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj, Boolean callerHasConnectionLock, Boolean asyncClose) +815
   System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) +4515
   System.Data.SqlClient.SqlCommand.RunExecuteNonQueryTds(String methodName, Boolean async, Int32 timeout, Boolean asyncWrite) +1390
   System.Data.SqlClient.SqlCommand.InternalExecuteNonQuery(TaskCompletionSource`1 completion, String methodName, Boolean sendToPipe, Int32 timeout, Boolean asyncWrite) +538
   System.Data.SqlClient.SqlCommand.ExecuteNonQuery() +290
   newprofile.btnUpdate_Click(Object sender, EventArgs e) +759
   System.Web.UI.WebControls.Button.RaisePostBackEvent(String eventArgument) +155
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +3804

I'm at a loss and appreciate any help that can be given.

Answer 1

Update syntax is completely invalid as stated by @JBKing.

Update statements are of form:

UPDATE myTableName SET field=new_value WHERE condition=some_value

Also, to avoid possible injections, do not pass field values directly into SQL command. Use parameters How to use parameters "@" in an SQL command in VB

Answer 2

cmd.CommandText = "UPDATE Profile (FirstName, LastName, Email, Telephone, EmployeeID, NTLogin) VALUES ('" & lblFirstName.Text & "','" & lblLastName.Text & "','" & lblEmail.Text & "','" & lblPhone.Text & "','" & lblEID.Text & "','" & lblNT.Text & "') Where [EmployeeID] = '" & lblEID.text & "'"

Should be like this:

cmd.CommandText = "UPDATE Profile SET FirstName='"&lblFirstName.Text&"', LastName='"&lblLastName.Text&"', Email='"&lblEmail.Text&"', Telephone='"&lblPhone.Text&"', EmployeeID='"&lblEID.Text&"', NTLogin='"&lblNT.Text&"' Where [EmployeeID] = '" & lblEID.text & "'"

I would be careful about last names like "O'Connor" that may break with your SQL as there are reasons stored procedures or parameters are preferred in most cases to prevent SQL injection attacks.

Answer 3

Thanks to everyone who provided some assistance. Between the examples and links shared, I was able to rebuild my command so that it update properly and is now setup using parametrized queries rather than a direct insert statement, or at least what appears correct to me, and is working.

Below is my final code.

Try
        Dim con As New SqlConnection
        Dim cmd As New SqlCommand

        con.ConnectionString = "Data Source=server;Initial Catalog=database;Integrated Security=True"
        con.Open()
        cmd.Connection = con
        cmd.CommandText = ("UPDATE Profile SET FirstName = @FirstName, LastName = @LastName, Email = @Email, Telephone = @Telephone, EmployeeID = @EmployeeID, NTLogin = @NTLogin, Organization = @Organization, Permission = @Permission Where [EmployeeID] = '" & eID & "'")
        cmd.Parameters.Add("@FirstName", SqlDbType.VarChar).Value = lblFirstName.Text
        cmd.Parameters.Add("@LastName", SqlDbType.VarChar).Value = lblLastName.Text
        cmd.Parameters.Add("@Email", SqlDbType.VarChar).Value = lblEmail.Text
        cmd.Parameters.Add("@Telephone", SqlDbType.VarChar).Value = lblPhone.Text
        cmd.Parameters.Add("@EmployeeID", SqlDbType.VarChar).Value = lblEID.Text
        cmd.Parameters.Add("@NTLogin", SqlDbType.VarChar).Value = lblNT.Text
        cmd.Parameters.Add("@Organization", SqlDbType.VarChar).Value = lblOrg.Text
        cmd.Parameters.Add("@Permission", SqlDbType.VarChar).Value = "requestor"

        cmd.ExecuteNonQuery()
        con.close
        lblValid.Text = "Record Updated Successfully"
    Catch ex As System.Exception
        lblValid.Text = (ex.Message)
    End Try

Thanks!