damn sql...

[area91]

Hey. I am working on a project in SQL Server & VB.NET. On the web form there is a single line textbox and a mutli-line textbox. When you click the button it’s supposed to update a entry in the SQL Database. But when I try using this code it won’t work, or it will but it will be all strange??!??!

Dim strRedirect As String
        strRedirect = Request("uid")
        Dim tempstringa As String = TextBox1.Text
        Dim tempstringb As String = TextBox2.Text
        Dim cmd As SqlCommand
        Dim cnn As SqlConnection
        cnn = New SqlConnection("server=localhost;user=dex2;pwd=password1;database=pocketdotnet;")
        Dim tempstringc As String = "UPDATE " & Me.Session.Item("workgroup") & "News set title='%%%%', disc='%%%%%' where uid='" & strRedirect & "'"
        tempstringc = Replace(tempstringc, "'%%%%'", "'" + Server.HtmlEncode(tempstringa) + "'")
        tempstringc = Replace(tempstringc, "'%%%%%'", "'" + Server.HtmlEncode(tempstringb) + "'")
        cmd = New SqlCommand(Server.HtmlEncode(tempstringc), cnn)
        cnn.Open()
        cmd.ExecuteNonQuery()
        cnn.Close()