Syntax Error in SQL UPDATE statement but it all seems ok :( - mysql

Question

I am getting this error with one of my tables in a database:
(An exception of type System.Data.OleDb.OleDbException occurred in System.Data.dll but was not handled in user code
Additional information: Syntax error in UPDATE statement.)
It allows me to read from it but when I come to add a new record or update it using an SQL query it gives me this error, I have checked, double checked and triple checked but can't see anything wrong with it...strange thing is is I took it from another table which I know was working and made sure I changed all the variables but to no avail!
Apologies if you all think this is very dirty code, its my first year project and I'm still getting my head round quicker ways to do things!
If anyone could have a look at it and see if they can figure it out, it would be much appreciated!
Sub Update()
Dim cs As String = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" + Server.MapPath("mydatabasename") + ";"
Dim cn As New OleDbConnection(cs)
Dim cmd As OleDbCommand
Dim r As OleDbDataReader
Dim ite As String
Dim siz As String
Dim quantit As String
Dim pric As String
Dim sourc As String
Dim updatestockstrings As String
updatestockstrings = Request.QueryString("updatestock")
ite = itm.Value
siz = sze.Value
quantit = qty.Value
pric = prc.Value
sourc = imgsrc.Value
If ite = "" Then
parMsg.InnerHtml = "Please add an item name"
ElseIf siz = "" Then
parMsg.InnerHtml = "Please add a size"
ElseIf quantit = "" Then
parMsg.InnerHtml = "Please add a quantity"
ElseIf pric = "" Then
parMsg.InnerHtml = "Please state a price"
ElseIf sourc = "" Then
parMsg.InnerHtml = "Please add an image source"
Else
cmd = New OleDbCommand("UPDATE Stocks Set Item='" & ite & "', Size='" & siz & "', Quantity='" & quantit & "', Price='" & pric & "', ImageSource='" & sourc & "' WHERE StockID=" & updatestockstrings & ";", cn)
cn.Open()
r = cmd.ExecuteReader()
Do While r.Read()
Loop
cn.Close()
parMsg.InnerHtml = "Update Successful!"
End If
End Sub

Answer 1

SIZE is a reserved word in MS-Access, you need to put square brackets around it
[SIZE]=......
But I really suggest to use a parameterized query to defend yourself from SQL Injection and parsing problems (What happens if one or more of your input strings contains a single quote?)
cmd = New OleDbCommand("UPDATE Stocks Set Item=?, [Size]=?, Quantity=?, " & _
"Price=?, ImageSource=? WHERE StockID=?", cn)
cmd.Parameters.AddWithValue("#p1", item)
cmd.Parameters.AddWithValue("#p2", siz)
cmd.Parameters.AddWithValue("#p3", quantit )
cmd.Parameters.AddWithValue("#p4", pric)
cmd.Parameters.AddWithValue("#p5", sourc)
cmd.Parameters.AddWithValue("#p6", updatestockstrings)
But this is still not enough. You should pass parameters with the correct datatype for the underlying database field. So, for example, if the database field Price is a decimal column then you need to convert the pric variable to a decimal value (and this requires that you parse it to be sure that you have received a valid decimal value)

Answer 2

In extension to #Steve's answer, on your posting,
You have to use ExecuteNonQuery on statements like INSERT, UPDATE, and DELETE. It returns the number of records affected but not a ResultSet to read records from.
ExecuteReader is for SELECT statements that returns a set of records to read.
Change:
cn.Open()
r = cmd.ExecuteReader()
Do While r.Read()
Loop
cn.Close()
To:
cn.Open()
cmd.ExecuteNonQuery()
cn.Close()
Unless required, capturing the result of ExecuteNonQuery into an integer is optional.