Получение записей базы данных SQL Server для обновления? VB.NET

Question

У меня возникла проблема с обновлением моей базы данных SQL Server. Я думаю, что что-то не так с синтаксисом, но я не уверен.

Я попытался написать его даже в самом SQL-сервере, и я все еще вижу ошибку «синтаксиса», но я не понимаю, что не так с синтаксисом! Он работает каждый раз, когда я помещаю в основном тот же код, и ничего не изменилось! ... есть это? LOL

Private Sub Button8_Click(sender As System.Object, e As System.EventArgs) Handles Button8.Click 
    'update salesperson button 
    Dim myconnection As New SqlConnection("server=classified;database=classified") 
    myconnection.Open() 
    Dim mycommand As SqlCommand 
    Dim theQuery As String = "SELECT * FROM Salespeople WHERE [First Name]=@FirstName AND [Last Name]=@LastName AND [Home Address]=@HomeAddress AND City=@City AND State=@State AND [Phone Number]=@PhoneNumber" 
    Dim repeatChecker As SqlCommand = New SqlCommand(theQuery, myconnection) 
    'mycommand.ExecuteNonQuery() 
    If TextBox6.Text = "" Then 
     MsgBox("You must add a first name.", MsgBoxStyle.Exclamation) 
    ElseIf TextBox7.Text = "" Then 
     MsgBox("You must add a last name.", MsgBoxStyle.Exclamation) 
    ElseIf TextBox8.Text = "" Then 
     MsgBox("You must add a home address.", MsgBoxStyle.Exclamation) 
    ElseIf TextBox9.Text = "" Then 
     MsgBox("You must add a city.", MsgBoxStyle.Exclamation) 
    ElseIf TextBox10.Text.Length <> 2 Then 
     MsgBox("State abbreviation needed.", MsgBoxStyle.Exclamation) 
    ElseIf TextBox11.Text = "" Or TextBox12.Text = "" Or TextBox13.Text = "" Then 
     MsgBox("Please ensure you have entered a valid telephone number: (XXX) (XXX) (XXXX).", MsgBoxStyle.Exclamation) 
    ElseIf Firs.IsInputNumeric(TextBox11.Text) = False Or Firs.IsInputNumeric(TextBox12.Text) = False Or Firs.IsInputNumeric(TextBox13.Text) = False Then 
     MsgBox("Please ensure you have entered a valid telephone number: (XXX) (XXX) (XXXX).", MsgBoxStyle.Exclamation) 
    ElseIf TextBox11.Text.Length <> 3 Or TextBox12.Text.Length <> 3 Or TextBox13.Text.Length <> 4 Then 
     MsgBox("Please ensure you have entered a valid telephone number: (XXX) (XXX) (XXXX).", MsgBoxStyle.Exclamation) 
    Else 
     repeatChecker.Parameters.Add("@FirstName", SqlDbType.VarChar).Value = Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox6.Text) 
     repeatChecker.Parameters.Add("@LastName", SqlDbType.VarChar).Value = Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox7.Text) 
     repeatChecker.Parameters.Add("@HomeAddress", SqlDbType.VarChar).Value = Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox8.Text) 
     repeatChecker.Parameters.Add("@City", SqlDbType.VarChar).Value = Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox9.Text) 
     repeatChecker.Parameters.Add("@State", SqlDbType.VarChar).Value = TextBox10.Text.ToUpper 
     repeatChecker.Parameters.Add("@PhoneNumber", SqlDbType.VarChar).Value = TextBox11.Text + "-" + TextBox12.Text + "-" + TextBox13.Text 
     Using reader As SqlDataReader = repeatChecker.ExecuteReader() 
      If reader.HasRows Then 
       ' User already exists 
       MsgBox("This salesperson already exists in the database.", MsgBoxStyle.Exclamation) 
      Else 
       reader.Close() 
       mycommand = New SqlCommand("UPDATE Salespeople SET [First Name]='" + Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox6.Text) + "', [Last Name]='" + Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox7.Text) + "', [Home Address]='" + Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox8.Text) + "', City='" + Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox9.Text) + "', State='" + TextBox10.Text.ToUpper + "', [Phone Number]='" + TextBox11.Text + "-" + TextBox12.Text + "-" + TextBox13.Text + "' WHERE [First Name]=@FirstName, [Last Name]=@LastName, [Home Address]=@HomeAddress, City=@City, State=@State, [Phone Number]=@PhoneNumber)", myconnection) 
       mycommand.ExecuteNonQuery() 
       BindGridSalespeople() 
       TabControl1.SelectTab(0) 

       Dim FirstNameDisplay As String = Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox1.Text) 
       Dim LastNameDisplay As String = Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox2.Text) 
       MsgBox("Salesperson " + FirstNameDisplay + " " + LastNameDisplay + " successfully added.") 
      End If 
     End Using 
     myconnection.Close() 

    End If 
End Sub 

В частности, эта линия в нижней части:

mycommand = New SqlCommand("UPDATE Salespeople SET [First Name]='" + Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox6.Text) + "', [Last Name]='" + Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox7.Text) + "', [Home Address]='" + Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox8.Text) + "', City='" + Globalization.CultureInfo.CurrentCulture.TextInfo.ToTitleCase(TextBox9.Text) + "', State='" + TextBox10.Text.ToUpper + "', [Phone Number]='" + TextBox11.Text + "-" + TextBox12.Text + "-" + TextBox13.Text + "' WHERE [First Name]=@FirstName, [Last Name]=@LastName, [Home Address]=@HomeAddress, City=@City, State=@State, [Phone Number]=@PhoneNumber)", myconnection) 

---

IS MY ФОРМА ВХОД ПРАВИЛЬНОЕ И СОДЕРЖАТ АТАК SQL путем инъекций?

---

Private Sub Button1_Click(sender As System.Object, e As System.EventArgs) Handles Button1.Click 
    Dim myconnection As New SqlConnection("server=CLASSIFIED;database=classified") 
    myconnection.Open() 
    Dim loginQuery As String = " SELECT Username, Password FROM Accounts WHERE (Username = @Username) AND (Password = @Password)" 
    Dim loginCommand As SqlCommand = New SqlCommand(loginQuery, myconnection) 
    loginCommand.Parameters.Add("@Username", SqlDbType.VarChar).Value = TextBox1.Text 
    loginCommand.Parameters.Add("@Password", SqlDbType.VarChar).Value = TextBox2.Text 

    Using reader As SqlDataReader = loginCommand.ExecuteReader() 
     If reader.HasRows Then 
      ' User already exists 
      MsgBox("Logged in successfully as " & TextBox1.Text, MsgBoxStyle.Information) 
      Firs.Show() 


     Else 
      MsgBox("Invalid username or password.", MsgBoxStyle.Critical) 

     End If 
    End Using 
     myconnection.Close() 

End Sub 

Answer 1

Помимо структурных изменений рекомендуется ставить комментариями, есть проблемы с ИНЕКЕ. 1: Удалите скобки после параметра PhoneNumber. 2: Разные, где клаузулы должны быть разделены символом «И» вместо запятых.

"' WHERE [First Name]=@FirstName, [Last Name]=@LastName, [Home Address]=@HomeAddress, City=@City, State=@State, [Phone Number]=@PhoneNumber)", myconnection) 

становится:

"' WHERE [First Name]=@FirstName AND [Last Name]=@LastName AND [Home Address]=@HomeAddress AND City=@City AND State=@State AND [Phone Number]=@PhoneNumber", myconnection)