So, I am trying to figure out where the TOTAL_CHG is coming from. Below is a snippet of where it is first used (not defined at all before).
...
sStrBalance = " (TOTAL_CHG - (ISNULL((SELECT SUM(isnull(t.amount, 0)) FROM transactions t " & _
" WHERE cp.contpolid = t.contpolid AND t.tran_date <= '" & GRepdate & "'), 0) + " & _
" ISNULL((SELECT SUM(isnull(dirpayamt, 0)) FROM bkrtrans bkr " & _
" WHERE cp.contpolid = bkr.contpolid), 0))) "
...
And then the next block of code that references it again is as follows:
...
strSQL = strSQL & vbCrLf & " SELECT cp.Contpolid, cp.CTYPE_ID, cp.C#, cp.REV, " & _
vbCrLf & "CASE WHEN cp.Div_Code = 'GM' THEN 'SLP' ELSE 'SCA' END, " & _
vbCrLf & "cp.Effective_ as EFFDATE, ADJUSTMENT, cp.terminatio, cp.TOTAL_CHG, " & _
vbCrLf & " ISNULL((SELECT SUM(isnull(t.amount, 0)) FROM transactions t " & _
vbCrLf & " WHERE cp.contpolid = t.contpolid AND t.tran_date <= '" & GRepdate & "'), 0) AS Payments, " & _
vbCrLf & " ISNULL((SELECT SUM(isnull(dirpayamt, 0)) FROM bkrtrans bkr " & _
vbCrLf & " WHERE cp.contpolid = bkr.contpolid), 0) AS BrkPayment, " & _
sStrBalance & " AS Balance, cast(0 as numeric(12,2)) as SixtyDays, cast(0 as numeric(12,2)) as NinetyDays , " & _
vbCrLf & " cast(0 as numeric(12,2)) as OverNinetyDays , CASE WHEN Register_D IS NULL THEN 'N' ELSE CASE WHEN Register_D < '" & GRepdate & "' THEN 'Y' ELSE 'N' END END "
strSQL = strSQL & vbCrLf & " FROM CONTRACTS_POLICIES cp (NOLOCK) /*JOIN Salesmen s (NOLOCK) ON s.salesmenid = cp.sales1*/ " & _
vbCrLf & " Where cp.CTYPE_ID = 1 And cp.Cancel_dat Is Null and CP.Sales1 is Not NULL " & _
vbCrLf & " AND ((CP.Effective_ <= '" & GRepdate & "' AND CP.Rev = 0) OR (CP.Adjustment <= '" & GRepdate & "' AND CP.Rev > 0)) " & _
vbCrLf & " AND NOT((" & sStrBalance & " > 0 AND cp.Effective_ <= '01/01/1996') OR (" & sStrBalance & "< 0 AND cp.Effective_ <= '01/01/1998')) " & _
vbCrLf & " And " & sStrBalance & " <> 0 "
...
What table is it even coming from? It seems like it is defined in the first block of code but isn't really a value yet.
Related
I want to run a string dynamically.
I'm trying to run a VBA loop to build a SQL Union for each record after the first. There could be anywhere from 1 record to 100. I want this to be dynamic so I don't have to limit the number of entries.
Example:
If I have 5 records it creates the SQL query with 4 unions. All the same data etc.
I'm trying to do is this:
When someone opens a form they will enter a list of pack numbers, from that they will select the range of offers under each pack number (All Offers, Promo, or Buyer).
The code then builds a union query for each pack number based on the the offer range they selected.
The output is all the data on those Offers under that pack number.
My full code: (I thought it necessary to get the full picture)
Private Sub ReviewButton_Click()
Dim Owner As String
Dim db As DAO.Database
Dim rs As DAO.Recordset
Dim qdfPassThrough As QueryDef
Dim strSeasonSQL As String
Dim strSeason As String
Dim strType As String
Owner = GetNamespace("MAPI").Session.CurrentUser.AddressEntry
If Me.NewRecord = True Then
Me!Owner.Value = Owner
End If
Set db = CurrentDb
Set rs = CurrentDb.OpenRecordset("RetailEntry")
'Set rs = CurrentDb.OpenRecordset("SELECT * FROM RetailEntry")
strSeason = [Forms]![Retail_Navigation]![NavigationSubform].[Form]![cboSeason]
strType = rs.Fields("Offer").Value '[Forms]![ReviewButton]![RetailEntry].[Form]![Offer].Value
On Error GoTo 1
1:
'Build Initial Query based on first record and make sure there are records
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
If Not (rs.EOF And rs.BOF) Then
rs.MoveFirst
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
'All Offers
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
If rs.Fields("Offer") = "All Offers" Then
StrSQL = "Set NoCount ON DROP TABLE #catcov; " _
& "SELECT DISTINCT mailyear, offer, description, firstreleasemailed, season_id, offer_type, " _
& "case when description like '%Promo%' then 'Promo' " _
& "Else 'Buyer' end As addtype " _
& "INTO #catcov " _
strSELECT = "FROM supplychain_misc.dbo.catcov; " _
& "SELECT DISTINCT " _
& "a.PackNum " _
& ",a.Description " _
& ",a.CatID " _
& ",DATEPART(QUARTER, FirstReleaseMailed) as Quarter " _
& ",a.RetOne " _
& ",a.Ret2 " _
& ",a.ORIGINALRETAIL " _
& ",a.DiscountReasonCode " _
& ",b.Season_id " _
& ",a.year " _
& ",addtype "
strFROM = "FROM PIC704Current a JOIN #CatCov b ON (a.CatID = b.Offer) and (a.Year = b.MailYear) " _
strWHERE = "WHERE b.Offer_Type In('catalog', 'insert', 'kicker', 'statement insert', 'bangtail', 'onsert', 'outside ad') " _
& " and b.Season_id = '" & strSeason & "' " _
& " and (Case when b.FirstReleaseMailed >= cast(dateadd(day, +21, getdate()) as date) then 1 else 0 end) = 1 "
StrSQL = StrSQL & vbCrLf & strSELECT & vbCrLf & strFROM & vbCrLf & strWHERE
'Promo/Core
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
ElseIf rs.Fields("Offer") = "Promo" Or rs.Fields("Offer") = "Buyer" Then
StrSQL = "Set NoCount ON DROP TABLE #catcov; " _
& "SELECT DISTINCT mailyear, offer, description, firstreleasemailed, season_id, offer_type, " _
& "case when description like '%Promo%' then 'Promo' " _
& "Else 'Buyer' end As addtype " _
& "INTO #catcov " _
strSELECT = "FROM supplychain_misc.dbo.catcov; " _
& "SELECT DISTINCT " _
& "a.PackNum " _
& ",a.Description " _
& ",a.CatID " _
& ",DATEPART(QUARTER, FirstReleaseMailed) as Quarter " _
& ",a.RetOne " _
& ",a.Ret2 " _
& ",a.ORIGINALRETAIL " _
& ",a.DiscountReasonCode " _
& ",b.Season_id " _
& ",a.year " _
& ",addtype "
strFROM = "FROM PIC704Current a JOIN #CatCov b ON (a.CatID = b.Offer) and (a.Year = b.MailYear) " _
strWHERE = "WHERE b.Offer_Type In('catalog', 'insert', 'kicker', 'statement insert', 'bangtail', 'onsert', 'outside ad') " _
& " and b.Season_id = '" & strSeason & "' and b.addtype = '" & strType & "' " _
& " and (Case when b.FirstReleaseMailed >= cast(dateadd(day, +21, getdate()) as date) then 1 else 0 end) = 1 "
StrSQL = StrSQL & vbCrLf & strSELECT & vbCrLf & strFROM & vbCrLf & strWHERE
End If
'Build/Loop Unions for each record after the first
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
rs.MoveNext
strType = rs.Fields("Offer").Value
Do Until rs.EOF = True
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
'All Offers
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
If rs.Fields("Offer") = "All Offers" Then
StrUnion = "UNION SELECT DISTINCT " _
& "a.PackNum " _
& ",a.Description " _
& ",a.CatID " _
& ",DATEPART(QUARTER, FirstReleaseMailed) as Quarter " _
& ",a.RetOne " _
& ",a.Ret2 " _
& ",a.ORIGINALRETAIL " _
& ",a.DiscountReasonCode " _
& ",b.Season_id " _
& ",a.year " _
& ",addtype "
strFROMnxt = "FROM PIC704Current a JOIN #CatCov b ON (a.CatID = b.Offer) and (a.Year = b.MailYear) " _
strWHEREnxt = "WHERE b.Offer_Type In('catalog', 'insert', 'kicker', 'statement insert', 'bangtail', 'onsert', 'outside ad') " _
& " and b.Season_id = '" & strSeason & "' " _
& " and (Case when b.FirstReleaseMailed >= cast(dateadd(day, +21, getdate()) as date) then 1 else 0 end) = 1 "
StrSQL2 = StrUnion & vbCrLf & strFROMnxt & vbCrLf & strWHEREnxt
'Promo/Buyer
'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
ElseIf rs.Fields("Offer") = "Promo" Or rs.Fields("Offer") = "Buyer" Then
StrUnion = "UNION SELECT DISTINCT " _
& "a.PackNum " _
& ",a.Description " _
& ",a.CatID " _
& ",DATEPART(QUARTER, FirstReleaseMailed) as Quarter " _
& ",a.RetOne " _
& ",a.Ret2 " _
& ",a.ORIGINALRETAIL " _
& ",a.DiscountReasonCode " _
& ",b.Season_id " _
& ",a.year " _
& ",addtype "
strFROMnxt = "FROM PIC704Current a JOIN #CatCov b ON (a.CatID = b.Offer) and (a.Year = b.MailYear) " _
strWHEREnxt = "WHERE b.Offer_Type In('catalog', 'insert', 'kicker', 'statement insert', 'bangtail', 'onsert', 'outside ad') " _
& " and b.Season_id = '" & strSeason & "' and b.addtype = '" & strType & "' " _
& " and (Case when b.FirstReleaseMailed >= cast(dateadd(day, +21, getdate()) as date) then 1 else 0 end) = 1 "
StrSQL2 = StrUnion & vbCrLf & strFROMnxt & vbCrLf & strWHEREnxt
End If
'Move to next Record and loop till EOF
rs.MoveNext
Loop
'If there are no Records then error
Else
MsgBox "There are no Pack Numbers Entered."
End If
'END QUERY
''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
'Build Retail Bump File Pass Through Query
db.QueryDefs.Delete "qryMaster"
Set qdfPassThrough = db.CreateQueryDef("qryMaster")
qdfPassThrough.Connect = "ODBC;DSN=SupplyChainMisc;Description=SupplyChainMisc;Trusted_Connection=Yes;DATABASE=SupplyChain_Misc;"
qdfPassThrough.ReturnsRecords = True
qdfPassThrough.sql = StrSQL & vbCrLf & StrSQL2
rs.Close
Set rs = Nothing
DoCmd.OpenForm "SubCanButton"
DoCmd.OpenQuery "MasterQuery"
DoCmd.Close acForm, "ReviewButton"
End Sub
First, you do a "union distinct" when you don't include ALL:
UNION ALL
SELECT DISTINCT ...
Thus, as your selected records seem the same, only one will returned.
Second, including ALL or not, your concept doesn't make much sense. Why union a lot of identical records? Even if they hold different IDs only, they seem to be pulled from the same table, which you could with a single query.
Third, casting a date value to a date value does nothing good, so:
cast(dateadd(day, +21, getdate()) as date)
can be reduced to:
dateadd(day, +21, getdate())
I'm trying to add to the following query:
strSQL = "SELECT fldName, blkName, CDbl(fldValue) " & _
"FROM dbSecurities2 as S " & _
"WHERE " & _
"S.isin='" & Code & "' " & _
"AND " & _
"S.fldName='" & fldName & "' "
A row that makes the sum of the fldValue like:
strSQL = "SELECT fldName, blkName, CDbl(fldValue) " & _
"FROM dbSecurities2 as S " & _
"UNION " & _
"SELECT Sum(fldValue) AS fldValue " & _
"WHERE " & _
"S.isin='" & Code & "' " & _
"AND " & _
"S.fldName='" & fldName & "' "
the error is:
Run -time error '3141'. The SELECT statement includes a reserved word or an argument name that is misspelled or missing, or the punctuation is incorrect
I found this is working:
strSQL = "SELECT fldName, blkName, CDbl(fldValue) " & _
"FROM dbSecurities2 as S " & _
"WHERE " & _
"S.isin='" & Code & "' " & _
"AND " & _
"S.fldName='" & fldName & "' " & _
"UNION " & _
"SELECT '' AS fldName, 'Total' AS Total, Sum(CDbl(fldValue)) " & _
"FROM dbSecurities2 AS B " & _
"WHERE " & _
"B.isin='" & Code & "' " & _
"AND " & _
"B.fldName='" & fldName & "' "
This should run as expected:
strSQL = "SELECT fldName, blkName, CDbl(fldValue) " & _
"FROM dbSecurities2 AS S " & _
"WHERE " & _
"S.isin='" & Code & "' " & _
"AND " & _
"S.fldName='" & fldName & "' " & _
"UNION ALL " & _
"SELECT TOP 1 "", "Total", Sum(CDbl(fldValue)) " & _
"FROM dbSecurities2"
If you have Null values, use Nz:
strSQL = "SELECT fldName, blkName, CDbl(Nz(fldValue, 0)) " & _
"FROM dbSecurities2 AS S " & _
"WHERE " & _
"S.isin='" & Code & "' " & _
"AND " & _
"S.fldName='" & fldName & "' " & _
"UNION ALL " & _
"SELECT TOP 1 "", "Total", Sum(CDbl(Nz(fldValue, 0))) " & _
"FROM dbSecurities2"
I've got this:
sql = "INSERT INTO instroom ( " & _
"team_id, " & _
"proces_id, " & _
"datum, " & _
"aantal_instroom, " & _
"ctime, " & _
"cuser, " & _
"mtime, " & _
"muser " & _
") "
sql = sql & "SELECT " & _
"team_id, " & _
"proces_id, " & _
"datum, " & _
"SUM(aantal_instroom), " & _
"#" & Format(MTime, "yyyy-mm-dd hh:mm:ss") & "#, " & _
"" & mod_global.RealUserID & ", " & _
"#" & Format(MTime, "yyyy-mm-dd hh:mm:ss") & "#, " & _
"" & mod_global.RealUserID & " " & _
"FROM tmp_import_instroom " & _
"WHERE userid = '" & EscapeString(LCase(mod_global.RealUser)) & "' " & _
"AND team_id <> 0 " & _
"AND proces_id <> 0 "
sql = sql & "GROUP BY team_id, proces_id, datum " & _
"HAVING SUM(aantal_cases) > 0 "
When it goes through:
-- Execute Query
Private Function executeSQL(ByVal sql As String, Optional ByVal autoCommit As Boolean = False) As Boolean
On Error GoTo executeSQLError
executeSQL = False
If mod_global.DevStart Then QueryNum = QueryNum + 1
If mod_global.DevStart Then Call saveQueryToFile(sql)
' Check if database is open
If Not testConn Then
Call openDB
End If
If startTrans Then
db.Execute sql
executeSQL = True
If autoCommit Then
executeSQL = commitDB
End If
End If
DoEvents
Exit Function
executeSQLError:
Debug.Print ("executeSQL - " & Err.Number & " : " & Err.Description)
Call writeToLog("executeSQL - " & Err.Number & " : " & Err.Description)
End Function
I get the error message
"Runtime Error 3061: Too few parameters. Expected 1.".
What am I missing? I did debug.print and still can't find something wrong.
Here are my column names from tmp_import_instroom:
results of debug.print
insert into instroom (
team_id
, proces_id
, datum
, aantal_instroom
, ctime
, cuser
, mtime
, muser
)
select
team_id
, proces_id
, datum
, SUM(aantal_instroom)
, #2017-02-23 20:22:33#
, 310
, #2017-02-23 20:22:33#
, 310
from tmp_import_instroom
where userid = 'xg30222'
and team_id <> 0
and proces_id <> 0
group by team_id
, proces_id
, datum
having SUM(aantal_cases) > 0
Unless it's not showing, there's no ctime, cuser, mtime or muser in your table. Therefore, you need to alias your calculated fields.
sql = sql & "SELECT " & _
"team_id, " & _
"proces_id, " & _
"datum, " & _
"SUM(aantal_instroom) as aantal_instroom, " & _
"#" & Format(MTime, "yyyy-mm-dd hh:mm:ss") & "# as ctime, " & _
"" & mod_global.RealUserID & " as cuser, " & _
"#" & Format(MTime, "yyyy-mm-dd hh:mm:ss") & "# as mtime, " & _
"" & mod_global.RealUserID & " as muser " & _
"FROM tmp_import_instroom " & _
"WHERE userid = '" & EscapeString(LCase(mod_global.RealUser)) & "' " & _
"AND team_id <> 0 " & _
"AND proces_id <> 0 "
I am trying to count records in an access table where certain criteria are met and insert the totals into another table in one record. I am doing so through vba and am trying to create a sql statement in there but for some reason it says I have too many line continuations when I try to add in anymore and I am really confused as to why. Any help would be greatly appreciated.
intYear = InputBox("What year is it currently?", "Year Input")
DoCmd.DeleteObject acTable, "ThisTable"
strCreate = "CREATE TABLE MarketSegmentTotals (" & vbCrLf & _
"[State Medicaid] TEXT," & vbCrLf & _
"Commercial TEXT," & vbCrLf & _
"HIX TEXT," & vbCrLf & _
"MMP TEXT," & vbCrLf & _
"[CMS Part D (CY " & intYear & ")] TEXT," & vbCrLf & _
"[CMS Part D (CY " & (intYear + 1) & ")] TEXT" & vbCrLf & _
");"
strCount = "INSERT INTO MarketSegmentTotals([State Medicaid], [Commercial], [HIX], [MMP], [CMS Part D (CY " & intYear & ")], [CMS Part D (CY " & (intYear + 1) & ")] ) " & _
"SELECT A.cnt, B.cnt, C.cnt, D.cnt, E.cnt " & _
"FROM ( " & _
"SELECT COUNT([FORMULARY ID]) as cnt " & _
"FROM ImportMetricsIDs " & _
"WHERE [Market Segment]= 'State Medicaid' " & _
") AS A " & _
", ( " & _
"SELECT COUNT([FORMULARY ID]) as cnt " & _
"FROM ImportMetricsIDs " & _
"WHERE [Market Segment]= 'Commercial' " & _
") as B " & _
", ( " & _
"SELECT COUNT([FORMULARY ID]) as cnt " & _
"FROM ImportMetricsIDs " & _
"WHERE [Market Segment]= 'HIX' " & _
") AS C " & _
", ( " & _
"SELECT COUNT([FORMULARY ID]) as cnt " & _
"FROM ImportMetricsIDs " & _
"WHERE [Market Segment]= 'MMP' " & _
") AS D "
VBA limits the number of lines joined by line continuation characters.
You can change this to redefine the variable to break the number of line continuation.
strCount = "blahblahblah" & _
"moreblahblahblah" & _
"lastblahforabit"
strCount = strCount & "evenmoreblah" & _
"toomuchblahblahblah"
Or eliminate the line continuation entirely.
strCount = "blahblahblah"
strCount = strCount & "moreblahblahblah"
strCount = strCount & "lastblahforabit"
strCount = strCount & "evenmoreblah"
strCount = strCount & "toomuchblahblahblah"
I have the following code to query in VB6:
SQL = " if object_id('tempdb..#MovSeq','U') is not null drop table #MovSeq;" & _
" declare #Data_Inicio datetime, #Data_Fim datetime; set dateformat dmy; set #Data_Inicio = DataInicio; set #Data_Fim = DataFinal; set #Data_Fim = DateAdd(day, +1, #Data_Fim); " & _
" with Mov as ( SELECT EI.Cod_Empresa, EI.Cod_Estoque, EI.Cod_Produto, 'E' as Tipo_Mov, E.Dta_Entrada as Data_Mov, EI.id_Doc as NF, EI.Qtde, EI.V_Unitario, EI.V_Total " & _
" from Entrada_Itens as EI inner join Entrada as E on EI.Cod_Empresa=E.Cod_Empresa and EI.id_Doc=E.id_Doc " & _
" where E.Dta_Entrada >= #Data_Inicio and EI.Cod_Empresa='" & Sys.Empresa & "' and EI.Cod_Estoque='" & dcEstoque.BoundText & "' and EI.Cod_Produto='" & dtProdutos.BoundText & "' " & _
" Union " & _
" SELECT SI.Cod_Empresa, SI.Cod_Estoque, SI.Cod_Produto, 'S', S.Dta_Entrada , SI.id_Doc, -SI.Qtde, SI.V_Unitario, SI.V_Total " & _
" from Saida_Itens as SI inner join Saida as S on SI.Cod_Empresa=S.Cod_Empresa and SI.id_Doc=S.id_Doc " & _
" where S.Dta_Entrada >= #Data_Inicio and SI.Cod_Empresa='" & Sys.Empresa & "' and SI.Cod_Estoque='" & dcEstoque.BoundText & "' and SI.Cod_Produto='" & dtProdutos.BoundText & "' " & _
" Union " & _
" SELECT Cod_Empresa, Cod_Estoque, Cod_Produto, 'A', #Data_Inicio, null, null, null, null " & _
" From Estoque " & _
" where Cod_Empresa='" & Sys.Empresa & "' and Cod_Estoque='" & dcEstoque.BoundText & "' and Cod_Produto='" & dtProdutos.BoundText & "') " & _
" SELECT *, Seq= row_number() over (partition by Cod_Empresa, Cod_Estoque, Cod_Produto order by Data_Mov desc, Tipo_Mov desc) into #MovSeq from Mov; " & _
" create unique clustered index IndMovSeq on #MovSeq (Cod_Empresa, Cod_Estoque, Cod_Produto, Seq); " & _
" SELECT M.Cod_Empresa, M.Cod_Estoque, M.Cod_Produto, P.Descricao," & _
" Estoque= case when M.Seq=1 then E.Qtde_Estoque else (E.Qtde_Estoque - (SELECT sum(Mi.Qtde) from #MovSeq as Mi " & _
" Where Mi.Cod_Empresa = M.Cod_Empresa And Mi.Cod_Estoque = M.Cod_Estoque And Mi.Cod_Produto = M.Cod_Produto and Mi.Seq < M.Seq)) end " & _
" from #MovSeq as M inner join " & _
" Estoque as E on M.Cod_Empresa=E.Cod_Empresa and M.Cod_Estoque=E.Cod_Estoque and M.Cod_Produto=E.Cod_Produto inner join " & _
" Produtos as P on M.Cod_Empresa=P.Cod_Empresa and M.Cod_Estoque=P.Cod_Estoque and M.Cod_Produto=P.Cod_Produto " & _
" where Data_Mov < #Data_Fim " & _
" order by M.Cod_Empresa, M.Cod_Estoque, M.Cod_Produto, Seq desc; " & _
" drop table #MovSeq;"
the error appears 'invalid columm name' when run showing DataInicio as a reason
I know the error is in the assignment of the variable. but how to solve.
Thanks for the help...
Your type of code is very prone to SQL Injection attacks...
Are you escaping the variable values correctly? A simple quote (') in one of the variables can change the SQL string completely...
You should consider using parameters to pass values instead of building SQL commands using string concatenation.