syntax error in string in query expression

Question

im getting error where "Syntax error in string in query EXPRESSION 'Username = user' i think the problem is in "me.Username.tag" but im stuck.

conn = New OleDbConnection(Get_Constring)
        conn.Open()
        cmd.Connection = conn
        cmd.CommandType = CommandType.Text
        cmd.CommandText = "select Username, fname,  lname, mname, [password], [level], Question, answer from Instructor where Username= '" & Me.txtusername.Tag

        dr = cmd.ExecuteReader
        If dr.HasRows Then
            While dr.Read
                Me.txtusername.Tag = dr("Username")
                Me.txtfname.Text = IIf(Not IsDBNull(dr("fname")), dr("fname"), "")
                Me.txtlname.Text = IIf(Not IsDBNull(dr("lname")), dr("lname"), "")
                Me.txtinitial.Text = IIf(Not IsDBNull(dr("mname")), dr("mname"), "")
                Me.txtpassword.Text = IIf(Not IsDBNull(dr("password")), dr("password"), "")
                Me.lbllevel.Text = IIf(Not IsDBNull(dr("level")), dr("level"), "")
                Me.txtusername.Text = IIf(Not IsDBNull(dr("Username")), dr("Username"), "")
                Me.cmbquestion.Text = IIf(Not IsDBNull(dr("Question")), dr("Question"), "")
                Me.txtanswer.Text = IIf(Not IsDBNull(dr("answer")), dr("answer"), "")
            End While
        End If

David · Accepted Answer · 2013-09-25 14:00:52Z

3

You didn't close your quotes in the query:

where Username= '" & Me.txtusername.Tag

should be:

where Username= '" & Me.txtusername.Tag & "'"

Important: Your code is potentially vulnerable to SQL injection attacks. Please use parameterized queries. Something like this:

cmd.CommandText = "select Username, fname,  lname, mname, [password], [level], Question, answer from Instructor where Username= @username"
Dim parameter As New SqlParameter()
parameter.ParameterName = "@username"
parameter.SqlDbType = SqlDbType.NVarChar
parameter.Value = Me.txtusername.Tag
cmd.Parameters.Add(parameter);

answered Sep 25, 2013 at 14:00

David

221k42 gold badges245 silver badges337 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Carlos Landeras · Accepted Answer · 2013-09-25 13:58:52Z

2

I think the problem is you are not closing the single quote.

Try with this:

cmd.CommandText = "select Username, fname,  lname, mname, [password], [level], Question, answer from Instructor where Username= '" & Me.txtusername.Tag & "'"

answered Sep 25, 2013 at 13:58

Carlos Landeras

11.1k11 gold badges61 silver badges84 bronze badges

1 Comment

user2715202 Over a year ago

my bad, so simple, its been 2 days practicing code in vb.net thats why. :D thank you so much :)

Sai Avinash · Accepted Answer · 2013-09-25 14:00:08Z

1

you have not closed the single quote which is opened at the end of the query

answered Sep 25, 2013 at 14:00

Sai Avinash

4,75117 gold badges63 silver badges100 bronze badges

Collectives™ on Stack Overflow

syntax error in string in query expression

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related