VB.NET 2010 ADD STATEMENT - vb.net

Question

i have this code on my ADD button, is there's other way to shorten this statement of code.
Private Sub btnAdd_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnAdd.Click
On Error GoTo ErrSQL
Dim cmd As New OleDb.OleDbCommand
If Not cnn.State = ConnectionState.Open Then
'Open connection if it is not yet open
cnn.Open()
End If
cmd.Connection = cnn
'check whether add new update
If Me.txtstdID.Tag & "" = "" Then
'add new
'add data to table
cmd.CommandText = "INSERT INTO inventory (ID,BRAND,SPECIFICATION,STATUS) Values ('" & Me.txtstdID.Text & "','" & Me.cboBrand.Text & "','" & Me.txtDescription.Text & "','" & strStat & "')"
cmd.ExecuteNonQuery()
Else
'update data in table
cmd.CommandText = "UPDATE inventory SET ID =" & Me.txtstdID.Text & ",BRAND='" & Me.cboBrand.Text & "', SPECIFICATION='" & Me.txtDescription.Text & "', STATUS = '" & strStat & "', WHERE ID=" & Me.txtstdID.Text & ""
cmd.ExecuteNonQuery()
End If
'refresh data in list
RefreshData()
'clear form
Me.btnClear.PerformClick()
'close connection
cnn.Close()
Exit Sub
ErrSQL:
MsgBox(Err.Description)
End Sub

Answer 1

There isn't too much to do to shorten the code, there is a lot to do to prevent Sql Injection and parsing problems.
I will try to change your code to this
Try
Using cnn = new OleDbConnection(constring)
Dim cmd As New OleDb.OleDbCommand
cnn.Open()
cmd.Connection = cnn
Dim cmdText as String
'check whether add new update
If Me.txtstdID.Tag & "" = "" Then
cmdText = "INSERT INTO inventory (ID,BRAND,SPECIFICATION,STATUS) " +
"Values (#ID, #Brand, #specs, #stat)"
else
cmdText = "UPDATE inventory SET ID=#ID, BRAND=#Brand,SPECIFICATION=#specs" +
"STATUS = #stat WHERE ID=#ID"
End If
cmd.CommandText = cmdText
cmd.Parametes.AddWithValue("#ID", Me.txtstdID.Text)
cmd.Parametes.AddWithValue("#Brand", Me.cboBrand.Text)
cmd.Parametes.AddWithValue("#specs", Me.txtDescription.Text)
cmd.Parametes.AddWithValue("#stat", strStat)
cmd.ExecuteNonQuery()
End Using
'refresh data in list
RefreshData()
'clear form
Me.btnClear.PerformClick()
Catch(x As Exception)
MsgBox(x.Message)
End Try
I was tempted to remove the redundant SET ID=#ID in the Update statement, but, then you have to add the #ID parameter after the other parameters because in OleDb the parameter order matters