updating a sql 2005 database using text boxes in vb.net

问题

I have a VB.Net form which allows the user to update the customer details such as name, contact no:, etc. So when the customer enters the new name for the customer name etc. the application should update the corresponding field in the existing entry that relates to the customer ID.

Dim cn As New SqlConnection
Dim cmd As New SqlCommand
Dim adapter As New SqlDataAdapter
Dim dt As New DataTable

cn.ConnectionString = ("Data Source=NIMO-HP\SQLEXPRESS;Initial Catalog=FYP_db;Integrated Security=True")
cmd.Connection = cn
cn.Open()

cmd.CommandText = " UPDATE TblCustomerDetails (compID, compName, compContact, compAddress, compFax, compEmail, compPayterm, compTaxscheme, compPaymode, compRemarks ) SET Values ('" & lblCID.Text & "', '" & txtCname.Text & "', '" & txtCpno.Text & "', '" & txtCaddrs.Text & "','" & txtCfax.Text & "', '" & txtCemail.Text & "', '" & cmbPterm.Text & "','" & cmbTaxschm.Text & "',' " & cmbPmode.Text & "', '" & txtRemarks.Text & "')  WHERE compID = '" & lblCID.Text & "';"

cmd.ExecuteNonQuery()
MsgBox("Account updated!!", MsgBoxStyle.Information, "Updation complete")

回答1:

Your using a INSERT syntax for your UPDATE statement. Your UPDATE statement should have the form:

UPDATE tableName
SET    col1 = val1,
       col2 = val2,
       col3 = val3
WHERE  someColumn = someValue

Additionally, you are wide open to SQL Injection attacks by using non-parameterized queries. Finally, I would use a Using blocks to ensure your connection and command are properly closed and disposed of.

Putting it all together it would look something like this:

Using Dim cn As SqlConnection = New SqlConnection("Data Source=NIMO-HP\SQLEXPRESS;Initial Catalog=FYP_db;Integrated Security=True")

    cn.Open()

    Dim sqlQuery As String = "UPDATE TblCustomerDetails " + _
                             "SET compName = @compName, " + _
                             "compContact = @compContact, " + _
                             "compAddress = @compAddress, " + _
                             "compFax = @compFax, " + _
                             "compEmail = @compEmail, " + _
                             "compPayterm = @compPayterm, " + _
                             "compTaxscheme = @compTaxscheme, " + _
                             "compPaymode = @compPaymode, " + _
                             "compRemarks = @compRemarks " + _
                             "WHERE compID = @compID"

    Using Dim cmd As SqlCommand = New SqlCommand(sqlQuery, cn)

        cmd.Parameters.AddWithValue("@compFax", txtCname.Text)
        cmd.Parameters.AddWithValue("@compContact", txtCpno.Text)
        cmd.Parameters.AddWithValue("@compAddress", txtCaddrs.Text)
        cmd.Parameters.AddWithValue("@compFax", txtCfax.Text)
        cmd.Parameters.AddWithValue("@compEmail", txtCemail.Text)
        cmd.Parameters.AddWithValue("@compPayterm", cmbPTerm.Text)
        cmd.Parameters.AddWithValue("@compTaxscheme", cmbTaxschm.Text)
        cmd.Parameters.AddWithValue("@compPaymode", cmbPmode.Text)
        cmd.Parameters.AddWithValue("@compRemarks", txtRemarks.Text)
        cmd.Parameters.AddWithValue("@compID", lblCID.Text)

        Dim result As Integer

        result = cmd.ExecuteNonQuery()

        If result = 1 Then
            MsgBox("Account updated!!", MsgBoxStyle.Information, _
                   "Updation complete")
        Else
            MsgBox("Account not updated!!", MsgBoxStyle.Information, _
                   "Updation not complete")
        End If
    End Using
End Using

There are a few more things to note in the above code sample:

First, I removed compID from the list of values to update. You're using that in your WHERE query, so I think you would have interesting results in your query if you're trying to update the same column you are using as part of your WHERE clause. Additionally, the source for that value is a Label, which tells me it's not supposed to be changed.

Secondly, ExecuteNonQuery() returns an int with the number of rows affected. In this case, it should be 1 - if it's not 1, I have you show a different message box.

Thirdly, cmbPTerm, cmbTaxxshm and cmbPmode sound like ComboBox to me, and you're not going to get what I think you're expecting using their Text property. I think you'll want SelectedText - hard to say without knowning how your ComboBoxes are bound. I'll leave that as an exercise for you :)

Fourth, I broke the UPDATE query up across several lines simply for readability - you don't have to do it that way, as long as the query is correct.

Finally, I'd suggest using MessagBox.Show() vs MsgBox.

回答2:

    Dim cnn As New SqlConnection
    Dim cmd As New SqlCommand

    cnn.ConnectionString = ("Data Source=NIMO-HP\SQLEXPRESS;Initial Catalog=FYP_db;Integrated Security=True")
    cmd.Connection = cnn
    cnn.Open()
    cmd.CommandText = "update TblCustomerDetails set compName='" & txtCname.Text & "' , compContact = '" & txtCpno.Text & "' , compAddress = '" & txtCaddrs.Text & "' , compFax = '" & txtCfax.Text & "' , compEmail = '" & txtCemail.Text & "' , compPayterm = '" & cmbPterm.Text & "' , compTaxscheme = '" & cmbTaxschm.Text & "' , compPaymode = '" & cmbPmode.Text & "' , compRemarks = '" & txtRemarks.Text & "' where compID = '" & lblCID.Text & "'"
    cmd.ExecuteNonQuery()
    cnn.Close()
    MessageBox.Show("entry updated!!!")

来源：https://stackoverflow.com/questions/17503778/updating-a-sql-2005-database-using-text-boxes-in-vb-net

标签

vb.net

sql-server-2005