[RESOLVED] Updating SQL Database Table

I am trying to update the password field in a table called tb_Users for a given username. The following code works fine when I use literal values for the new password and for the Username.

Imports System.Data.SqlClient
Public Class PasswordForm
Private Sub ContinueButton_Click(sender As System.Object, e As System.EventArgs) Handles ContinueButton.Click
If TextBox1.Text = TextBox2.Text Then
Me.Label4.Visible = False
Dim SQLStr As String
Dim ConnString As String
ConnString = "Data Source=mikespc\sqlexpress; Initial Catalog=db_PigginGifts; Integrated Security=True"
'SQL Staments
'SQL query = myQuery = "SQL Statment"
SQLStr = "UPDATE tb_Users SET Password = 'whogoesthere' Where Username = 'Joe Blogs'"
'Write to SQL
Dim SQLConn As New SqlConnection() 'The SQL Connection
Dim SQLCmd As New SqlCommand() 'The SQL Command
SQLConn.ConnectionString = ConnString 'Set the Connection String
SQLConn.Open() 'Open the connection
SQLCmd.Connection = SQLConn 'Sets the Connection to use with the SQL Command
SQLCmd.CommandText = SQLStr 'Sets the SQL String
SQLCmd.ExecuteNonQuery() 'Executes SQL Commands Non-Querys only
SQLConn.Close() 'Close the connection
MsgBox(SQLStr)
Else
Me.Label4.Visible = True
End If
End Sub


How do I substitute the characters 'whogoesthere' for the contents of a TextBox called TextBox1 and the characters 'Joe Blogs' with the contents of a public varialble called PubUsers ?

one word: Parameters

-tg

Also password is a reserved word and should nkt be used as a field name. If it can not be changed then it must be enclosed in square brackets