1

Just wondering can you pass 2 parameters ( @Insertparanamehere ) in 1 sql command via VB? I have some code below ( sample code ) and I am just wondering is this possible.

Command = New SqlCommand("Update Boards Set CDF_Supplier_Tx='" + SupplierNameTxt.Text + "'  Where CDF_Supplier_tx IN ( Select Supplier From Suppliers Where Supplier = '" + SupplierNameTxt.Text + "')", connection)

Where it says '" + SupplierNameTxt.Text + "' could this be potentially replaced with @Insertnameparaname from here?

If this is unclear as to which I will try to explain this a little more so my code would end up with 2x@ instead of the long supplierNameTxt.Text?

This is just a question , thank you in advance.

Yuriy Galanter
  • 38,833
  • 15
  • 69
  • 136
Kallumasaurus
  • 271
  • 1
  • 4
  • 15
  • I'd be careful if I were you, you are very vulnerable on SQL injections attacks with such a design. – Crono Feb 18 '14 at 17:09

1 Answers1

5

MyCommand = New SqlCommand("UPDATE SeansMessage SET Message1 = @TicBoxText1, Message2 = @TicBoxText2 WHERE Number = 1", dbConn) MyCommand.Parameters.AddWithValue("@TicBoxText1", TicBoxText1.Text) MyCommand.Parameters.AddWithValue("@TicBoxText2", TicBoxText2.Text)

See here:

How to use parameters "@" in an SQL command in VB

You can also use the same parameter multiple times in your SQL text.

Community
  • 1
  • 1
Jon Barker
  • 1,788
  • 15
  • 25