VBA: Why is my INSERT code not working? - vba

Question

I had this working a few weeks ago but now I'm not sure what I did that made it not work anymore. I don't even get an error message to figure out what could be wrong. When I click the button I made to insert a row into the table, nothing happens. The form gets cleared and the table gets requeried, but the INSERT part of the code doesn't do anything.
Public Sub Command125_Click()
'Add row for downtime
Dim dbsCurrent As Database
Set dbsCurrent = CurrentDb
dbsCurrent.Execute " INSERT INTO tbl_Downtime " _
& "(job, suffix, production_date, reason, downtime_minutes, comment, shift) VALUES " _
& "('" & Me.Text116 & "','" & Me.Text118 & "','" & Me.Text126 & "','" & Me.Text121 & "','" & Me.Text123 & "','" & Me.Text128 & "','" & Me.Text144 & "');"
Call ClearControl(Me.Text116)
Call ClearControl(Me.Text118)
Call ClearControl(Me.Text126)
Call ClearControl(Me.Text121)
Call ClearControl(Me.Text123)
Call ClearControl(Me.Text128)
Call ClearControl(Me.Text144)
Me.subrpt_DowntimeTable.Requery
End Sub
The code I'm trying based on #Hambone's answer:
Public Sub Command125_Click()
Dim dbsCurrent As Database
Set dbsCurrent = CurrentDb
Dim query As QueryDef
Dim sql As String
For Each query In CurrentDb.QueryDefs
If query.Name = "InsertDowntime" Then
Exit For
End If
Next query
If query Is Nothing Then
sql = "parameters " & _
"P1 text, P2 text, P3 Date, P4 Text, P5 Number, P6 Text, P7 Text;" & _
"insert into [tbl_Downtime] " & _
"(job, suffix, production_date, reason, downtime_minutes, comment, shift) " & _
" VALUES ([P1], [P2], [P3], [P4], [P5], [P6], [P7])"
Set query = CurrentDb.CreateQueryDef("InsertDowntime", sql)
End If
query.Parameters("P1").Value = "test1"
query.Parameters("P2").Value = "test2"
query.Parameters("P3").Value = Now()
query.Parameters("P4").Value = "test3"
query.Parameters("P5").Value = 15
query.Parameters("P6").Value = "Miles O'Brien is a darn good transporter chief"
query.Parameters("P7").Value = "test6"
query.Execute
MsgBox query.Parameters("P1").Value & query.Parameters("P2").Value & query.Parameters("P3").Value & query.Parameters("P4").Value & query.Parameters("P5").Value & query.Parameters("P6").Value & query.Parameters("P7").Value
Me.subrpt_DowntimeTable.Requery
End Sub

Answer 1

MarkB and gmiley are absolutely right about using parameters. It's a little more code up front and countless hours saved later. And, it's a good practice to get into.
That said, for a native Access query (not a ADO Database query), it's not the most straight-forward process in the world. The normal ADO stuff, in my opinion, starts to make sense after you do it a time or two, but for an Access query, I still have to go back and plagiarize old examples to get it to work.
In your case, I think something like this will do the trick:
Dim query As QueryDef
Dim sql As String
For Each query In CurrentDb.QueryDefs
If query.Name = "InsertDowntime" Then
Exit For
End If
Next query
If query Is Nothing Then
sql = "parameters " & _
"P1 text, P2 text, P3 Date, P4 Text, P5 Number, P6 Text, P7 Text;" & _
"insert into [tbl_Downtime] " & _
"(job, suffix, production_date, reason, downtime_minutes, comment, shift) " & _
" VALUES ([P1], [P2], [P3], [P4], [P5], [P6], [P7])"
Set query = CurrentDb.CreateQueryDef("InsertDowntime", sql)
End If
query.Parameters("P1").Value = "test1"
query.Parameters("P2").Value = "test2"
query.Parameters("P3").Value = Now()
query.Parameters("P4").Value = "test3"
query.Parameters("P5").Value = 15
query.Parameters("P6").Value = "Miles O'Brien is a darn good transporter chief"
query.Parameters("P7").Value = "test6"
query.Execute
You were pulling your data from text-boxes. I used hard-coded values to demonstrate that this also manages data-typing if your values are not all text. No need to 'quote' text or #hash# dates. You can obviously changes these back to Me.TextBox123 and alter the data types to match your actual fields in tbl_Downtime.
-- edit 12/3/15 --
The entire section of code from For Each query In CurrentDb.QueryDefs all the way prior to query.Parameters could theoretically be omitted if you already had a query with this query text in it (as in you went into Access, created a query, went from Design view to SQL view and typed this in and named it InsertDowntime):
parameters
P1 text, P2 text, P3 Date, P4 Text, P5 Number, P6 Text, P7 Text;
insert into [tbl_Downtime]
(job, suffix, production_date, reason, downtime_minutes, comment, shift)
VALUES ([P1], [P2], [P3], [P4], [P5], [P6], [P7])
Because you don't, I just created that through code. If you tried to create it again, Access would puke because InsertDowntime already exists.
Either way, once it exists, the way you can manage it is by saying
Dim query As QueryDef
Set query = CurrentDb.QueryDefs("InsertDowntime")
And then everything else should be as I have it.
Personally, I would go option 2 -- create the query in Access and keep it as a persistent object and access it the way I just listed above. I suppose I could have said that, but yours was a VBA-ish question, and I kept it VBA -- plus, I thought the ability to create a query dynamically is sort of cool.

Answer 2

I would not build the SQL-Statement in the Execute-Method.
Create a variable and build the string first. So you can debug the actual value and test it seperately.
You can also try the Option dbFailOnError for the Execute-Method.
Dim stmt as String
stmt = "INSERT INTO....."
dbsCurrent.Execute stmt, dbFailOnError
Test the INSERT Statement with different inputs. It is not important what a normal user will enter in a form but what he is allowed to do by the application. If the input is not checked and the user can enter everything he/she wants's then the query can fail, produce weird results or - as stated - allows SQL injection. The best SQL injection is the one you as a developer will never notice. So you would'n know that you have a problem.

Answer 3

As per our discussion, you would want to look into parametrized queries: https://support.microsoft.com/en-us/kb/181734
The primary reasons for this are that 1) It will ensure your code is safe from intentional or unintentional SQL injection. Since user input cannot always be controlled in free-form fields, ensuring that your query is parametrized makes it impossible to execute arbitrary code; and 2) Readability, it makes it a lot easier to read code when the values are parametrized.