title: How to use parameters "@" in an SQL command in VB
body: <p>I have this code to update my SQL database from data in a textbox, in VB. I need to use parameters in case the text contains a tic mark ,', or a quote ,", etc. Here is what I have:</p>
  
  <pre><code>dbConn = New SqlConnection("server=.\SQLEXPRESS;Integrated Security=SSPI; database=FATP")
      dbConn.Open()
  
      MyCommand = New SqlCommand("UPDATE SeansMessage SET Message = '" &amp; TicBoxText.Text &amp; _
                                              "'WHERE Number = 1", dbConn)
  
      MyDataReader = MyCommand.ExecuteReader()
      MyDataReader.Close()
      dbConn.Close()
  </code></pre>
  
  <p>And this is my lame attempt to set a parameter from what I have seen on the web, which I don't understand all that well.</p>
  
  <pre><code>dbConn = New SqlConnection("server=.\SQLEXPRESS;Integrated Security=SSPI; database=FATP")
      dbConn.Open()
  
      MyCommand = New SqlCommand("UPDATE SeansMessage SET Message = @'" &amp; TicBoxText.Text &amp; _
                                              "'WHERE Number = 1", dbConn)
  
      MyDataReader = MyCommand.ExecuteReader()
      MyDataReader.Close()
      dbConn.Close()
  </code></pre>
  
  <p>How do you do this? Cause if there is a ' mark in the textbox when I run the code, it crashes.</p>