vb.net - Update button error -

our program when click update button updates data in data grid view, what's wrong our codes? our code

private sub btnupdate_click(byval sender system.object, byval e system.eventargs) handles btnupdate.click     con.connectionstring = ("server=localhost;user id=root;password=;database=sample4")     try         con.open()         cmd             .connection = con              .commandtext = "update inventory set product_name='" & txtpn2.text & "',product_quantity='" & txtquan2.text & "',date='" & txtdate2.text & "' 1"             result = cmd.executenonquery             if result = 0                 msgbox("data has been updated!")             else                 msgbox("successfully updated!")                 .commandtext = "select product_name,product_quantity,date inventory"                 txtpn2.clear()                 txtquan2.clear()                 txtdate2.clear()                 txtpn2.focus()              end if         end     catch ex exception         msgbox(ex.message)     end try     con.close() end sub 

there lot of errors here, both logical , bad practices @ work.
starting logical errors first:

what think statement does? where 1 (i don't know if accepted database suppose works). doesn't locate precise record update, let every record in table receive same values specified in set list. need pass key identify precise record update. where keyfield=keyvalue keyfield name of column in table invetory values unique 1 record selected update

second logical problem: if result = 0 then wrong because result of executenonquery number of records updated/inserted/deleted. in case update sql updates record if finds one. update record if values same before. 0 instead means no record has been found clause (after fixing in first step). if 0 result no record exists in table match clause.

now bad practices.

set product_name='" & txtpn2.text &..... 

this string concatenation builds sql statement. wrong on many levels. if 1 of textboxes contains single quote whole text becomes syntactically invalid. malicious user write in textbox , create sql injection hack destroy database or grab sensitive informations. should use parameterized query

 .commandtext = "update inventory set product_name=@prod " & _                 ",product_quantity=@qty,date=@dt keyfield=@kvalue"  .parameters.add("@prod", sqldbtype.nvarchar).value =  txtpn2.text   .parameters.add("@qty", sqldbtype.int).value =  convert.toint32(txtquan2.text)  .parameters.add("@qty", sqldbtype.datetime).value =  convert.todatetime(txtdate2.text)  .parameters.add("@kvalue", sqldbtype.int).value =  kvalue  result = cmd.executenonquery 

second bad practice: keeping global objects connection , commands. these disposable objects, should used in know pattern. create, use, destroy free possible precious system resources. keeping them global gains nothing , @ risk leak resources. keep global (or better read app.config) connection string , apply using statement around connection , command