Here is a better way to build this query:
str = "update student " &
" set course= @course, name= @name, f_name= @fname, address= @address," &
" tel_no= @tel, qualification = @qualification, remarks= @remarks," &
" `school/college`=@school, fee= @fee" &
" where reg_no= @regno"
Using cn As New MySqlConnection("connection string here"), _
cmd As New MySqlCommand(str, cn)
'Use actual column types/lengths from your DB here
cmd.Parameters.Add("@course", MySqlDbType.VarChar, 15).Value = ComboBox1.Text
cmd.Parameters.Add("@name", MySqlDbType.VarChar, 25).Value = TextBox2.Text
cmd.Parameters.Add("@fname", MySqlDbtype.VarChar, 25).Value = TextBox3.Text
cmd.Parameters.Add("@address", MySqlDbType.VarChar, 120).Value = TextBox4.Text
cmd.Parameters.Add("@tel", MySqlDbType.VarChar, 25).Value = TextBox5.Text
cmd.Parameters.Add("@qualification", MySqlDbType.VarChar, 40).Value = TextBox6.Text
cmd.Parameters.Add("@remarks", MySqlDbType.VarString).Value = TextBox7.Text
cmd.Parameters.Add("@school", MySqlDbType.VarChar, 40).Value = TextBox8.Text
cmd.Parameters.Add("@fee", MySqlDbType.Decimal, 6, 2).Value = Convert.ToDecimal(TextBox10.Text)
cmd.Parameters.Add("@regno", MySqlDbType.Int32).Value = Integer.Parse(TextBox9.Text)
cn.Open()
cmd.ExecuteNonQuery()
End Using
This does a number of things for you:
- It prevents sql injection attacks
- It allows you to accept data that includes things like single quotes (
'). The code you have will fail if someone puts in a single quote.
- It handles things like date formatting for the sql automatically.
- It's faster, because the database server can cache the execution plan after it compiles the query, and use statistics over time to get better execution plans.
- It closes the db connection more reliably. The current code leaves the database connection hanging open if an exception is thrown.