vb.net - Syntax error in INSERT INTO statement for Access 2010 -


my insert statement apparently has syntax error. please explain why might be?

private sub register_click_1(byval sender system.object, byval e system.eventargs) handles register.click     dim studentnum string     dim password string     dim firstname string     dim lastname string     dim yrandsec string      studentnum = number.text()     password = pass.text     firstname = first.text     lastname = last.text     yrandsec = yrsec.text()      sql = "insert accounts(studno,password,firstname,lastname,yrandsec) values ('" & studentnum & "', '" & password & "', '" & firstname & "', '" & lastname & "', '" & yrandsec & "')"    - error here     cmd = new oledbcommand(sql, con)     con.open()     objcmd = new oledbcommand(sql, con)      if repass.text = pass.text = false         re.text = "*password didn't match!"         number.text = ""         pass.text = ""         repass.text = ""         con.close()     else         if number.text = "" or pass.text = "" or repass.text = "" or first.text = "" or last.text = "" or yrsec.text = ""             msgbox("please complete field", msgboxstyle.information, "failed create")         else             objcmd.executenonquery()             re.text = ""             msgbox("account has been created", msgboxstyle.information, "congrats!")             fade = 0.0 1.1 step 0.2                 login.opacity = fade                 login.show()                 me.hide()                 threading.thread.sleep(30)                 number.text = ""                 pass.text = ""                 repass.text = ""                 first.text = ""                 last.text = ""                 yrsec.text = ""             next         end if      end if end sub 

  1. password reserved word in access sql, need wrap column name in square brackets.

  2. you should use parameterized query protect against sql injection , make life easier.

try this

sql = "insert [accounts] ([studno],[password],[firstname],[lastname],[yrandsec]) " & _         "values (?, ?, ?, ?, ?)" con.open() objcmd = new oledbcommand(sql, con) objcmd.parameters.addwithvalue("?", studentnum) objcmd.parameters.addwithvalue("?", password) objcmd.parameters.addwithvalue("?", firstname) objcmd.parameters.addwithvalue("?", lastname) objcmd.parameters.addwithvalue("?", yrandsec) 

Comments

Popular posts from this blog

jOOQ update returning clause with Oracle -

java - Warning equals/hashCode on @Data annotation lombok with inheritance -

java - BasicPathUsageException: Cannot join to attribute of basic type -