I have not coded statements in this manner, but I would guess that you should change strSQL to take out the + signs. I usually just use a ? in mine and then make sure that if there are multiple parameters that you put them in the correct order.
I usually create my parameters as follows:
That just saves you from having to create and deal with a Parameter object. It is all created and added in one line.
cmd.Parameters.Add(New OldDb.OleDbParameter("@CodeNo", SqlDbType.SmallInt, 2, "CodeNo")).Value = "Test Rank"