Update data in database using vb and sql - sql

Question

i want to update the data using textbox in a database but i get the error message. the error is "Incorrect syntax near '('."
below is the code for update data
hopefully u all can help me to solve the problem. Thanks :)
dbSource = "Data Source=LAILATUL-PC\SERVER;Initial Catalog=HotelManagementSystem;Integrated Security=True"
con = New SqlConnection(dbSource)
con.Open()
Dim sqlUpdate As String = "UPDATE [Room] SET ([Room_Code], [Room_Type], [Room_No], [Room_Price], [Room_Status], [No_of_Occupancy]) VALUES (#RoomCode, #RoomType, #RoomNo, #RoomPrice, #RoomStatus, #NoOfOccupancy WHERE [Room_Code] = " & txtRoomCode.Text & " ) "
cmd = New SqlCommand(sqlUpdate)
cmd.Connection = con
cmd.Parameters.AddWithValue("#RoomCode", txtRoomCode.Text)
cmd.Parameters.AddWithValue("#RoomType", txtRoomType.Text)
cmd.Parameters.AddWithValue("#RoomNo", txtRoomNo.Text)
cmd.Parameters.AddWithValue("#RoomPrice", txtRoomPrice.Text)
cmd.Parameters.AddWithValue("#RoomStatus", txtRoomStatus.Text)
cmd.Parameters.AddWithValue("#NoOfOccupancy", txtNoOfOccupancy.Text)
cmd.ExecuteNonQuery()
MessageBox.Show("Successfully saved", "Record", MessageBoxButtons.OK, MessageBoxIcon.Information)

Answer 1

You are already using parameters don't forget the last one which could open your sql up to injection attacks.
Dim sqlUpdate As String = "UPDATE [Room] SET [Room_Code] = #RoomCode,
[Room_Type] = #RoomType, [Room_No] = #RoomNo, [Room_Price] = #RoomPrice
[Room_Status] = #RoomStatus, [No_of_Occupancy] = #NoOfOccupancy
WHERE [Room_Code] = #RoomCode"

Answer 2

Need to quote the room code text in the WHERE clause
Dim sqlUpdate As String = "UPDATE [Room] SET ([Room_Code], [Room_Type], [Room_No], [Room_Price], [Room_Status], [No_of_Occupancy]) VALUES (#RoomCode, #RoomType, #RoomNo, #RoomPrice, #RoomStatus, #NoOfOccupancy WHERE [Room_Code] = '" & txtRoomCode.Text & "' ) "
Edit
Or better yet make that a parameter too.

Answer 3

I believe that this statement:
Dim sqlUpdate As String = "UPDATE [Room] SET ([Room_Code], [Room_Type], [Room_No], [Room_Price], [Room_Status], [No_of_Occupancy]) VALUES (#RoomCode, #RoomType, #RoomNo, #RoomPrice, #RoomStatus, #NoOfOccupancy WHERE [Room_Code] = " & txtRoomCode.Text & " ) "
needs to be rewritten as follows:
Dim sqlUpdate As String = "UPDATE [Room] SET [Room_Code] = #RoomCode, [Room_Type] = #RoomType, [Room_No] = #RoomNo, [Room_Price] = #RoomPrice, [Room_Status] = #RoomStatus, [No_of_Occupancy] = #NoOfOccupancy WHERE [Room_Code] = '" & txtRoomCode.Text & "' ) "
You have two problems. You didn't quote your txtRoomCode.txt value, and that's not the correct syntax for an UPDATE statement, unless I'm really confused.