sql subquery syntax asp.net

Question

I am trying to excute this sql query

Dim str As String = "UPDATE table1 SET " & _
            "number = '" & strc & "'," & _
            "code = '" & "123" & "'," & _
            "line= '" & dd1.text & "'," & _
            "sellr = '" & txtrun.text & "'," & _
            "endu= '" & txtex1.value+txtex2.value & "'" & _
             "WHERE number IN (select table1.number" & _
"FROM table1 INNER JOIN table2 ON table1.number = table2.number" & _
"WHERE ((table1.username)='" &  session("username") & "' AND (table1.pass)='" & session("pass") & "' AND (table2.sellnum)='" & session("sellnum") & "'));"

there is a Syntax error in query expression and this is te first time I am using nested subquery

all the field are getting String values

So if someone can tell me what is the right approach to write this query I will be very grateful

Your code is wide open to SQL Injection. You should use parameterized queries. — Oded
– Oded, Commented Sep 27, 2011 at 19:31
Agree Oded... Create a Stored Procedure which takes those parameters and does the update. — Stephanie Page
– Stephanie Page, Commented Sep 27, 2011 at 19:38

Don Kirkby · Accepted Answer · 2011-09-27 19:30:45Z

4

You're missing spaces after table1.number and table2.number fields in the subquery.

I don't know where you're using this query, but you might want to read about SQL injection. When you stick strings together to build SQL, your code may be vulnerable to malicious users who put SQL code into the fields of your application.

answered Sep 27, 2011 at 19:30

Don Kirkby

56.7k28 gold badges225 silver badges307 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

bfavaretto Over a year ago

Another useful link on SQL injection: stackoverflow.com/questions/332365/…

Stephanie Page Over a year ago

Think SQL Injection may be an issue?

baaroz Over a year ago

Thanks Don ,it working like charm! by the way isnt it enough if I check the user input (to prevent sql injection)?

Don Kirkby Over a year ago

Perhaps, @baaroz, but it's usually easier and more effective to use parameterized queries or stored procedures. They will do all the checking for you.

Collectives™ on Stack Overflow

sql subquery syntax asp.net

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related