如何在VB.NET中使用此SQL UPDATE查询

Question

Here textbox11 contains a float value and combo box contains a string do i have to put text or selected item

cmd.CommandType = "UPDATE BALANCE SET OBBALANCE =  '"& TextBox11.Text &"' WHERE     CUSTOMERNAME = "& ComboBox1.Text & " "

It gives the following error:

Operator '&' is not defined for string " UPDATE BALANCE SET OBBALANCE = " and type 'DataRowView'.

Answer 1

Instead you should use parameters, as they are both escaped for sql injections and make more neat datapassing:

cmd.CommandType = " UPDATE BALANCE SET OBBALANCE =  @NEWBALANCE WHERE CUSTOMERNAME = @CUSTOMERNAME"

and add parameterwithvalue for:

"@NEWBALANCE", TextBox11.Text
"@CUSTOMERNAME", ComboBox1.Text

See http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlparameter.aspx

Answer 2

1. I would not recommend using inline SQL query. Use Stored Procedure instead and pass parameters.

2. If you pass Text - you will get the display value... if you want to pass the underlying value, then use "SelectedValue"

3. However to resolve your issue, use parameters.

Answer 3

The available CommandTypes are

StoredProcedure TableDirect Text

It looks like you want to set your CommandType to Text and set your CommandText to what you have there.

That said, I agree with stefan's answer about parameters.