How to use parameters “@” in an SQL command in VB

by

You are on the right path to avoiding Bobby Tables, but your understanding of @ parameters is incomplete.

Named parameters behave like variables in a programming language: first, you use them in your SQL command, and then you supply their value in your VB.NET or C# program, like this:

MyCommand = New SqlCommand("UPDATE SeansMessage SET Message = @TicBoxText WHERE Number = 1", dbConn)
MyCommand.Parameters.AddWithValue("@TicBoxText", TicBoxText.Text)

Note how the text of your command became self-contained: it no longer depends on the value of the text from the text box, so the users cannot break your SQL by inserting their own command. @TicBoxText became a name of the variable that stands for the value in the text of the command; the call to AddWithValue supplies the value. After that, your ExecuteReader is ready to go.

More Related Contents:

  1. Syntax not valid on word ‘ON’ in SQL join statement [closed]
  2. How do I create a parameterized SQL query? Why Should I?
  3. Passing multiple values for a single parameter in Reporting Services
  4. Parameterize an SQL IN clause
  5. including parameters in OPENQUERY
  6. How to set table name in dynamic SQL query?
  7. Pass table as parameter into sql server UDF
  8. The parameterized query expects the parameter which was not supplied
  9. Can we pass parameters to a view in SQL?
  10. “Order By” using a parameter for the column name
  11. Query for getting value from another record in same table and filter by difference greater than a gap threshold
  12. sql query if parameter is null select all
  13. Check if a parameter is null or empty in a stored procedure
  14. Parameterise table name in .NET/SQL?
  15. Call stored procedure with table-valued parameter from java
  16. look back in SQL
  17. to select all the employees who have joined most recently under king
  18. SQL to LINQ Tool [closed]
  19. Can a foreign key be NULL and/or duplicate?
  20. How to generate a range of dates in SQL Server
  21. SQL RANK() versus ROW_NUMBER()
  22. SQL SERVER: Get total days between two dates
  23. SQL Server 2008 – Help writing simple INSERT Trigger
  24. Best way to model Customer Address
  25. TRANSFORM and PIVOT in Access 2013 SQL
  26. Use Access SQL to do a grouped ranking
  27. Create parameterized VIEW in SQL Server 2008
  28. Can a COMMIT statement (in SQL) ever fail? How?
  29. “SELECT *” vs “SELECT ” for performance
  30. Postgres INTERVAL using value from table

Leave a Comment