Parameterizing sql in vb - sql

Question

I have this module call Procedure , and I want to parametrize it. I'm sending a string as the query to the procedure module . I look already in google but I could not find the answer to my problem.
Procedures.Insert("INSERT INTO Technician (tec_name, tec_email, rol_id) VALUES ('" & txt_tech.text & "', '" & txt_tech_email.text & "', " & cbo_tech_role.selectvalue.tostring & ")", "Technican Add Correct")
========================================
I will probably change it for .....
Procedures.Insert("INSERT INTO Technician (tec_name, tec_email, rol_id) VALUES ('#tech_name', '#tech_email', '#tech_role' ")", "Technican Add Correct")
================ But I dont know where I can Parametrized
Public Sub Insert(query As String, msg As String)
Dim cn As New SqlConnection(cs)
Dim cmd As New SqlCommand
Try
cn.Open()
With cmd
.CommandType = CommandType.Text
.CommandText = query
.Connection = cn
.Parameters.AddValueWith("#tech_name",txt_tech_name.text)
.Parameters.AddValueWith("#tech_email",txt_tech_email.text)
.Parameters.AddValueWith("#tech_rol",txt_tech_role.selectValue.tostring)
.ExecuteNonQuery()
End With
MessageBox.Show(msg, "INSERT", MessageBoxButtons.OK, MessageBoxIcon.Information)
Catch ex As Exception
MessageBox.Show(ex.Message.ToString, ". : : ERROR : : .", MessageBoxButtons.OK, MessageBoxIcon.Error)
Finally
If cn IsNot Nothing AndAlso cn.State <> ConnectionState.Closed Then
cn.Close()
cn = Nothing
End If
End Try
End Sub
Because I have a module that is separate from the main code , I'm not able to call the textboxes because they are separate from the main module ... any idea on how to do this ?? ... Dont be hard .. This is my 14 week working with VB.. :/

Answer 1

Add to the Insert function parameter for SqlParameters
Public Sub Insert(query As String, msg As String, params As SqlParameter())
Dim cn As New SqlConnection(cs)
Dim cmd As New SqlCommand
Try
cn.Open()
With cmd
.CommandType = CommandType.Text
.CommandText = query
.Connection = cn
If params IsNot Nothing AndAlso params.Count > 0 Then
.Parameters.AddRange(params)
End If
.ExecuteNonQuery()
End With
MessageBox.Show(msg,
"INSERT",
MessageBoxButtons.OK,
MessageBoxIcon.Information)
Catch ex As Exception
MessageBox.Show(ex.Message.ToString, ". : : ERROR : : .",
MessageBoxButtons.OK,
MessageBoxIcon.Error)
Finally
If cn IsNot Nothing AndAlso cn.State <> ConnectionState.Closed Then
cn.Close()
cn = Nothing
End If
End Try
End Sub
Then use it like this:
Dim query As String = "INSERT INTO Technician (tec_name, tec_email, rol_id) VALUES (#tech_name, #tech_email, #tech_role)"
Dim msg As String = "Technican Add Correct"
Dim params As SqlParameter() = {New SqlParameter("#tech_name",txt_tech_name.text),
New SqlParameter("#tech_email",txt_tech_email.text),
New SqlParameter("#tech_rol",txt_tech_role.selectValue.tostring)}
Procedures.Insert(query, msg, params)
Using array of SqlParameter give you a possibility for using same function with parameter type other then string

Answer 2

You can have it this way... it works for me.
String query = "INSERT INTO Technician(tec_name, tec_email, rol_id) VALUES(#tech_name, #tech_email, #tech_rolr)"
params = {"tech_name", "tech_email", "tech_rolr"}
values = {"" & txt_tech_name.text, "" & txt_tech_email.text, "" & txt_tech_role.selectValue.tostring()}
SaveUpdateDelete(query, params, values)
under module, you can put this
Public params() As String
Public values() As String
Public Sub SaveUpdateDelete(ByVal sql As String, ByVal parameters() As String, ByVal Values() As String)
If con.State = ConnectionState.Open Then
con.Close()
End If
con.Open()
command = New MySqlCommand(sql, con)
For i = 0 To parameters.Count - 1
command.Parameters.AddWithValue("#" & parameters(i).ToString, Values(i))
Next
command.CommandText = sql
command.ExecuteNonQuery()
con.Close()
End Sub
the method SaveUpdateDelete is applicable for adding, updating and deleting data.. your code will only differ in query... "insert, update, delete"