救命，数据库更新错误 两百分求解

[kld3000]

以下是主要代码
txtPassword1 原密码
txtPassword2 新密码
txtPassword3 确认密码

错误信息：
如果我用新密码是 XX，
那么它提示我

第 1 行: 'XX' 附近有语法错误。

还有一百分在：
http://expert.csdn.net/Expert/topic/1773/1773877.xml?temp=.8090937



Dim DBConn as OleDbConnection
Dim DBUpdate As New OleDbCommand
dim DBCommand as new oledbDataAdapter
dim DSpageData as new Dataset
DBConn = New OleDbConnection("Provider=sqloledb;" _
& "server=localhost;" _
& "Initial Catalog=os;" _
& "User Id=today;" _
& "Password=123123;")
dbcommand = new oledbDataAdapter _
("select userID,username,password from users where userName ='" &txtusername.text _
& "' and password = '"& txtPassword1.text _
& "'",dbconn)




DBCommand.Fill(DspageData, _
"userss")




If DSpageData.Tables("userss").Rows(0).item("password") = 0 Then
lblMessage.Text = "旧密码错误"

Else

DBUpdate.CommandText = "Update Users set " _
& " password=Convert(varchar(10),password) " _
& Replace (txtPassword2.Text,"'","''") _
& " where username= " _
& " &txtusername.text"

DBUpdate.Connection = DBConn
DBUpdate.Connection.Open
DBUpdate.ExecuteNonQuery()
'lblMessage.Text = lblMessage.Text & "用户名是: " & txtUserName.Text & "<BR>密码" & txtPassword2.Text
lblMessage.Text = "用户名是: " & txtUserName.Text & "<BR>密码" & txtPassword2.Text

end if

[killprograme]

你用oledbDataAdapter的selectcommand 添加参数，保证不会出错，不要用引号之类，很容易出错

[wacle]

为什么不用存储过程？
用存储过程应该就不会有上面的问题了，因为存储过程不需要根据参数类型确定是否加''，减少出错率，建议试一试

[风中飘扬的柳絮]

DBUpdate.CommandText = "Update Users set " _
& " password=Convert(varchar(10),'" _
& Replace (txtPassword2.Text,"'","''") _
& "') where username= '" _
& txtusername.text & "'"

[风中飘扬的柳絮]

你的SQL语句有错误，正确的应该是：
update Users set password=Convert(varchar(10),'wo de mima') where username='abce'
转换成程序就是我上面写的！

[yqdeng]

SQL错了

[kld3000]

我不会存储过程

而且工期紧，没机会学啊

我想作完这个一定要去好好学一下存储过程了