LOL Parameters are the way to go.. And yeah.. re-read the article...(REALLY READ IT)
If you still dont get it.. google "vb.net sql parameters" its really easy...

this:
Code:
mySQLCom = "Select Client_ID from Clients where Client_name='" & ClientName.Replace("'", "''") & "'"
is NOT a parameter... all you are doing is concatenating strings... which WILL cause errors.


it will look something like this...(this code wont work on its own!)

DIm CMD as new SqlCommand
CMD.commandText = "SELECT Client_Number FROM Clients WHERE client_name=@client_name" <<<< @client_name is the parameter
CMD.parameters.AddWithValue("@client_name",Company_Code) <<< company_code has your value in it... single quote/tickmarks/etc wont matter
OpenYourConnection
CMD.connection = YourConnection
CMD.executenonquery
Close your connection