problem with sql update statement

[chandrubngit]

I am working with a project using MS Access 2003 as backend database and vb.net 2003 as front end windows application. I need to update few records of table1 using the values given by the user through textboxes. At the same time I need to insert a new record in table2 using the same values of textboxes given by user. I tried with single adapter to update command for 1st table and insert command for 2nd table. Also tried with two adapters one for updating and one for inserting. But it is not working.bcoz in the where clause of update statement for 1st table one field value may contain null value or a value from textbox.

Dim query as string
Query=update table1 set status=?, details=? Where (userid=’” & TextBox1.Text.Trim & “’ And Priority=’” & TextBox2.Text.Trim & “’)

Here Textbox2 may be blank…if it is blank then query should update the corresponding row in database whose priority field value is blank & userid is textbox1 value.
Bcoz another same record may exist in database with priority value not null and userid (Textbox1 value).

I can tackle this by using the if condition….

If textbox2 value is blank, then I will use update statement like this

Query=update table1 set status=?, details=? Where (userid=’” & TextBox1.Text.Trim & “’ And Priority IS NULL)

If textbox2 contains a value then I will use

Query=update table1 set status=?, details=? Where (userid=’” & TextBox1.Text.Trim & “’ And Priority=’” & TextBox2.Text.Trim & “’)

But I want to know is there any better method….than this to do…?

Thanks in Advance…

[Thread1]

do you have primary keys on your tables? i would suggest to add primary keys to your tables. a primary key is a column or group of columns that uniquely identifies a record in a table. it will make your life easier in the where clause.

[hspc]

chandrubngit,
Using string concatenation to create a SQL statement is discouraged. This exposes your application to SQL injection attacks and other functional errors. You need to use parameterized queries instead.
About your style of doing the query, it's ok to check for values entered by user and call run appropriate query according to it.