sql subquery syntax asp.net

Question

I am trying to excute this sql query

Dim str As String = "UPDATE table1 SET " & _
            "number = '" & strc & "'," & _
            "code = '" & "123" & "'," & _
            "line= '" & dd1.text & "'," & _
            "sellr = '" & txtrun.text & "'," & _
            "endu= '" & txtex1.value+txtex2.value & "'" & _
             "WHERE number IN (select table1.number" & _
"FROM table1 INNER JOIN table2 ON table1.number = table2.number" & _
"WHERE ((table1.username)='" &  session("username") & "' AND (table1.pass)='" & session("pass") & "' AND (table2.sellnum)='" & session("sellnum") & "'));"

there is a Syntax error in query expression and this is te first time I am using nested subquery

all the field are getting String values

So if someone can tell me what is the right approach to write this query I will be very grateful

Your code is wide open to [SQL Injection](http://en.wikipedia.org/wiki/SQL_injection). You should use parameterized queries. — Oded, Sep 27 '11 at 19:31
Agree Oded... Create a Stored Procedure which takes those parameters and does the update. — Stephanie Page, Sep 27 '11 at 19:38

score 4 · Accepted Answer · answered Sep 27 '11 at 19:30

4

You're missing spaces after table1.number and table2.number fields in the subquery.

I don't know where you're using this query, but you might want to read about SQL injection. When you stick strings together to build SQL, your code may be vulnerable to malicious users who put SQL code into the fields of your application.

answered Sep 27 '11 at 19:30

Don Kirkby

53,582
27
205
286

2

Another useful link on SQL injection: http://stackoverflow.com/questions/332365/xkcd-sql-injection-please-explain – bfavaretto Sep 27 '11 at 19:33
Think SQL Injection may be an issue? – Stephanie Page Sep 27 '11 at 19:39
Thanks Don ,it working like charm! by the way isnt it enough if I check the user input (to prevent sql injection)? – baaroz Sep 27 '11 at 19:40
Perhaps, @baaroz, but it's usually easier and more effective to use parameterized queries or stored procedures. They will do all the checking for you. – Don Kirkby Sep 27 '11 at 20:09

sql subquery syntax asp.net

1 Answers1