Getting error while running the query

Question

Here is my code.

Dim con As OleDbConnection = New OleDbConnection("Provider=Microsoft.ACE.OLEDB.12.0;Data Source=C:\speednet\speed_net.accdb")
Dim com As New OleDbCommand
con.Open()
com.Connection = con
com.CommandText = "insert into users (name,username,password,user_type) values ('" & name1.Text & "' ,'" & username.Text & "' ,'" & password.Text & "','" & account_type.Text & "')"
com.ExecuteNonQuery()

The error:

Syntax error in insert into statement ...

Cant find out the problem.

Password is a reserved keyword in access. Use it with square brackets `[password]` — Steve, Dec 30 '14 at 14:49

score 2 · Accepted Answer · edited May 23 '17 at 12:15

Password is a reserved keyword in access. You need square brackets around that word.
But your query should also be modified to use a parameter approach instead of string concatenation, otherwise more dangerous situation will be possible. Read about Sql Injection and what happen if one of your concatenated string contains a single quote.

So

Using con = New OleDbConnection("....")
Using com = New OleDbCommand("insert into users " & _ 
                             "(name,username,[password],user_type) " & _ 
                             "values (@name, @uname,@pass,@acctype)", con)
    con.Open()
    com.Parameters.AddWithValue("@name", name1.Text)
    com.Parameters.AddWithValue("@uname", username.Text)
    com.Parameters.AddWithValue("@pass", password.Text)
    com.Parameters.AddWithValue("@acctype", account_type.Text)
    com.ExecuteNonQuery()
End Using
End Using

Getting error while running the query

1 Answers1