syntax error insert into statement vb.net

Question

pls help solve me this question.. im very new to this i can't add new employee to the table employee.. whenever i try to add it shows syntax error insert into statement

Public Class AddNewEmployee

    Dim dr As OleDbDataReader
    Dim da As OleDbDataAdapter
    Dim ds As DataSet
    Dim conn As New OleDbConnection(My.Settings.rayshadatabaseConnectionString)
    Dim cmd As OleDbCommand

    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click

        conn.Open()
        Try
            Dim str As String = "INSERT INTO employee" _
            & "(Employee Name, IC Number, HP Number, Address)" _
            & " Values (" _
            & "'" & txtEmployeeName.Text & "', " _
            & "'" & txtIC_Number.Text & "'," _
            & "'" & txtHP_Number.Text & "'," _
            & "'" & txtAddress.Text & "')"

            cmd = New OleDbCommand(str, conn)
            Dim i As Integer = cmd.ExecuteNonQuery()
            If i > 0 Then
                MessageBox.Show("Record Succesfully added.", "Process Completed", MessageBoxButtons.OK, MessageBoxIcon.Information)
            Else
                MessageBox.Show("Adding failed!", "Error", MessageBoxButtons.OK, MessageBoxIcon.Exclamation)
            End If
        Catch ex As Exception
            MessageBox.Show(ex.Message)
        Finally
            conn.Close()
            cmd.Dispose()
        End Try
        frmEmployee.loadR()
        Me.Close()
    End Sub
End Class

Your code is vulnerable to SQL Injection. Don't use string concatenation, use Parameterized statements instead. — Techie

Manoj Manoj · Accepted Answer · 2016-03-08T06:11:51

Replace this,

    Dim str As String = "INSERT INTO employee" _
    & "(Employee Name, IC Number, HP Number, Address)" _
    & " Values (" _
    & "'" & txtEmployeeName.Text & "', " _
    & "'" & txtIC_Number.Text & "'," _
    & "'" & txtHP_Number.Text & "'," _
    & "'" & txtAddress.Text & "')"

with this,

Dim str As String = "INSERT INTO employee" _
    & "([Employee Name], [IC Number], [HP Number], [Address])" _
    & " Values (" _
    & "'" & txtEmployeeName.Text & "', " _
    & "'" & txtIC_Number.Text & "'," _
    & "'" & txtHP_Number.Text & "'," _
    & "'" & txtAddress.Text & "')"

Thanks Manoj

syntax error insert into statement vb.net

1 Answers