SQL command to update in VB6

[GShaikh]

Hi all,

I am using VB6 and DAO connnection with Access.

I want to update the records in access using VB. The column name and comments to be updated will be provided by user in text box. Please provide me the SQL command for the same.

I tried below but not working

"UPDATE Sheet1 SET '"&text6.text&"'='"&text47.Text&"'Where Vertical = '" & Combo1.text & "'"

 

[Ken g6]

This looks like homework. We'll help, but we won't solve it for you.

I suggest you take that concatenated mess, add a statement to show the result of the concatenations (e.g. print or msgbox), and see if anything looks wrong.

If you don't see anything, I see a couple of things:

1.

Spoiler

Spacing

.
2.

Spoiler

Don't quote column names

.

 

[Tweak155]

Looks like your "SET FIELD" is surrounded by single quotes. Field names should not be surrounded by '... if they have spaces, surround them with [ and ].

EX:

"UPDATE Sheet1 SET ["&text6.text&"]='"&text47.Text&"'Where Vertical = '" & Combo1.text & "'"

Only use ' when you are matching or setting a text field value in the table.

 

[Ken g6]

Another issue comes to mind: You're using values directly out of textboxes, aren't you? So if any of those fields is, say, Robert'); DROP TABLE Students;--, you might have a problem.

 

[Markbnj]

Another issue comes to mind: You're using values directly out of textboxes, aren't you? So if any of those fields is, say, Robert'); DROP TABLE Students;--, you might have a problem.

Couldn't resist...

https://xkcd.com/327/

 

[Homerboy]

Couldn't resist...

https://xkcd.com/327/

That was the link he provided in his reply

 

[Cogman]

OP, if you didn't get what everyone is dancing around here. You have a very common and very dangerous problem. SQL strings should never be concatenated, ever. Doing so opens yourself up to SQL injection attacks which basically gives a crafty attacker full access to your database.

I would suggest reading up on parameterized queries. Here is a link to why's and hows in VB.
http://www.vbforums.com/showthread....-instead-of-putting-values-into-my-SQL-string