Trying to execute sql query but error occur like Syntax error (missing operator) in query expression

Question

I'm trying to execute below query but error occur like

Syntax error (missing operator) in query expression 9 ORDER BY empSalary.ID DESC.

cmd.CommandText = "UPDATE EmpSalary SET emp_Advance=" & TextBox7.Text & ",emp_salary=" & TextBox4.Text & " ORDER BY empSalary.ID DESC"

possible duplicate of http://stackoverflow.com/questions/21928185/syntax-error-in-query-expression — Mahadev
– Mahadev, Commented Jun 6, 2015 at 10:53
UPDATE EmpSalary SET emp_Advance=" & TextBox7.Text & ",emp_salary=" & TextBox4.Text WHERE <where clause> — Mahadev
– Mahadev, Commented Jun 6, 2015 at 10:57
What is the value present in the TextBox4.Text? if it is something like 1,2345.56 then stop here and read about parameterized queries. By the way, ORDER BY in an UPDATE query has no meanings. And beware, without a WHERE clause this command (when you manage to make it work) will update all the records in the table — Steve
– Steve, Commented Jun 6, 2015 at 11:05

Zohar Peled · Accepted Answer · 2015-06-06 17:16:43Z

0

First, you should never concatenate strings directly to your sql. This is a security risk. Google sql injection. Instead, you should use parameterized queries or stored procedures.

Second, the oreder by part has no meaning in this type of query, and perhaps is the reason you get this exception.

answered Jun 6, 2015 at 17:16

Zohar Peled

82.9k11 gold badges79 silver badges134 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Trying to execute sql query but error occur like Syntax error (missing operator) in query expression

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related