Запрос SQL-вставки с использованием VB 2013

Question

Private Sub ButtonCreate_Click (отправитель как объект, e как EventArgs) Обрабатывает ButtonCreate.Click Попробуйте, если TextUsername.Text = "" Тогда MsgBox («Иси terlebih dahulu ID пользователь») Остальное Koneksi () CMD = Новый SqlCommand («ВЫБЕРИТЕ имя пользователя»FROM tbl_pengguna WHERE username = '"+ TextUsername.Text +"' ", CONN) DRead = CMD.ExecuteReader DRead.Read () Если не DRead.HasRows, то Koneksi () CMD = Новая SqlCommand (" ВСТАВИТЬ INTO пароль пользователя (tbl_pengg), level_user) VALUES (?,?,?) ", CONN)

                With CMD
                    .Parameters.AddWithValue("?", TextUsername.Text)
                    .Parameters.AddWithValue("?", TextPassword.Text)
                    .Parameters.AddWithValue("?", ComboBoxLvU.Text)
                    .ExecuteNonQuery()
                End With
                CONN.Close()
            Else
                Koneksi()
                CMD = New SqlCommand("UPDATE tbl_pengguna SET password=?, hak_akses=? WHERE username=?", CONN)
                With CMD
                    .Parameters.AddWithValue("?", TextPassword.Text)
                    .Parameters.AddWithValue("?", ComboBoxLvU.Text)
                    .Parameters.AddWithValue("?", TextUsername.Text)
                    .ExecuteNonQuery()
                End With
                CONN.Close()
            End If
            CONN.Close()

            call_all()
        End If
    Catch ex As Exception
        MsgBox(ex.Message)
    End Try
End Sub`enter code here`

Answer 1

Private Sub ButtonCreate_Click(sender As Object, e As EventArgs) Handles ButtonCreate.Click
    If TextUsername.Text = "" Then
        MsgBox("Isi terlebih dahulu ID user")
        Exit Sub
    End If

    Try
        'Because of connection pooling you should create a **BRAND NEW CONNECTION OBJECT**
        Using conn As New SqlConnection("connection string here"), 
              cmd = New SqlCommand("SELECT username FROM tbl_pengguna WHERE username = @Username", conn)
            cmd.Parameters.Add("@Username", SqlDbType.NVarChar, 20).Value = TextUsername.Text

            conn.Open()
            Using rdr As SqlDataReader = cmd.ExecuteReader()
               cmd.Paramters.Clear()
               'Use actual database column values in this section.
               'Also: plain-text passwords? Is this amateur hour?
               If rdr.Read()
                   cmd.CommandText = "UPDATE tbl_pengguna SET password=@password, hak_akses=@hakakses WHERE username=@username"
                   cmd.Parameters.Add("@Username", SqlDbType.NVarChar, 20).Value = TextUsername.Text
                   cmd.Parameters.Add("@password", SqlDbType.NVarChar, 64).Value = TextPassword.Text
                   cmd.Parameters.Add("@hakakses", SqlDbType.NVarChar, 10).Value = ComboBoxLvU.Text
               Else 
                   cmd.CommandText = "INSERT INTO tbl_pengguna(username,password,level_user) VALUES (@Username, @password, @UserLevel)"
                   cmd.Parameters.Add("@Username", SqlDbType.NVarChar, 20).Value = TextUsername.Text
                   cmd.Parameters.Add("@password", SqlDbType.NVarChar, 64).Value = TextPassword.Text
                   cmd.Parameters.Add("@UserLevel", SqlDbType.NVarChar, 10).Value = ComboBoxLvU.Text
               End If
            End Using
            cmd.ExecuteNonQuery()
        End Using

        call_all()

    Catch ex As Exception
        MsgBox(ex.Message)
    End Try
End Sub

Answer 2

****i'm fix the error****TY Google
Private Sub ButtonCreate_Click(sender As Object, e As EventArgs) Handles ButtonCreate.Click
        Try
            If TextUsername.Text = "" Then
                MsgBox("Isi terlebih dahulu ID user")
            Else
                Koneksi()
                CMD = New SqlCommand("SELECT username FROM tbl_pengguna WHERE username = '" + TextUsername.Text + "'", CONN)
                DRead = CMD.ExecuteReader
                DRead.Read()
                If Not DRead.HasRows Then
                    Koneksi()
                    CMD = New SqlCommand("INSERT INTO tbl_pengguna(username,password,hak_akses) VALUES (@username,@password,@hak_akses)", CONN)
                    With CMD
                        .Parameters.AddWithValue("@username", TextUsername.Text)
                        .Parameters.AddWithValue("@password", TextPassword.Text)
                        .Parameters.AddWithValue("@hak_akses", ComboBoxLvU.Text)
                        .ExecuteNonQuery()
                    End With
                    CONN.Close()
                Else
                    Koneksi()
                    CMD = New SqlCommand("UPDATE tbl_pengguna SET password=@password, hak_akses=@hak_akses WHERE username=@username", CONN)
                    With CMD
                        .Parameters.AddWithValue("@password", TextPassword.Text)
                        .Parameters.AddWithValue("@hak_akses", ComboBoxLvU.Text)
                        .Parameters.AddWithValue("@username", TextUsername.Text)
                        .ExecuteNonQuery()
                    End With
                    CONN.Close()
                End If
                CONN.Close()

                call_all()
            End If
        Catch ex As Exception
            MsgBox(ex.Message)
        End Try
    End Sub`enter code here`