Incorrect syntax error near 'email'

Question

I'm running Visual studio and whenever I run my application it says "Incorrect syntax error near '(the email i enter appears here)'". I hope you can spot the mistake.

Within SQL server, my email column is called 'email'

Within Visual studio, the name of the input field for my email is called 'textEmail'

Public Sub AddCustomer(Firstname As String, Surname As String, Contactnum As String, Email As String)
    Try
        Dim strInsert As String = "INSERT INTO customers (firstname, surname, contactnum, email) " & _
                                  "VALUES  (" & _
                                  "'" & Firstname & "'," & _
                                  "'" & Surname & "'," & _
                                  "'" & Contactnum & "'," & _
                                  "'" & Email & "'"

        MsgBox(strInsert)

        SQLCon.Open()
        SQLcmd = New SqlCommand(strInsert, SQLCon)

        SQLcmd.ExecuteNonQuery()


        SQLCon.Close()

    Catch ex As Exception
        MsgBox(ex.Message)
    End Try





End Sub

End Class

Code within form:

    Private Sub cmdSave_Click(sender As Object, e As EventArgs) Handles cmdSave.Click
    'QUERY FOR CUSTOMER
    SQL.RunQuery("SELECT * FROM customers WHERE customers.email = '" & txtEmail.Text & "' ")

    If SQL.SQLDS.Tables(0).Rows.Count > 0 Then
        MsgBox("This Email alredy exists!")
        Exit Sub
    Else
    CreateCustomer()
    End If
End Sub

      Public Sub CreateCustomer()
    ' ADD CUSTOMER TO DATABASE
    SQL.AddCustomer(txtFirst.Text, txtSur.Text, txtNum.Text, txtEmail.Text)


End Sub
End Class

Thanks for your time.

You need to [parameterise your SQL](http://stackoverflow.com/questions/542510/). — Dour High Arch, May 03 '15 at 03:04

score 0 · Accepted Answer · answered May 03 '15 at 02:57

You are missing closing bracket

Dim strInsert As String = "INSERT INTO customers (firstname, surname, contactnum, email) " & _
                                  "VALUES  (" & _
                                  "'" & Firstname & "'," & _
                                  "'" & Surname & "'," & _
                                  "'" & Contactnum & "'," & _
                                  "'" & Email & "')"

Incorrect syntax error near 'email'

1 Answers1