Spooky Semi-dynamic Sql Update Statement

Hi,

I rewrote my working Sql statement to prevent Sql Injections. I copied some code I used in another project but this time I can't get it to work, possibly because it's an update statement and not an Insert one, which I used before.

Sorry for the boring question, but does anyone have a clue what's wrong with the syntax?

Here's the original code (I changed the parameter names for clarity and security):

    Dim conn As SqlConnection = New SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings("MyConnectionString").ConnectionString)
    Dim strSQL As String = "Update MyTable Set " & typ & num & " = '" & pname & "' WHERE personID = " & fid
    Dim cmd As SqlCommand = New SqlCommand(strSQL, conn)

Here's the code from codebehind:

    Dim conn As SqlConnection = New SqlConnection(System.Configuration.ConfigurationManager.ConnectionStrings("MyConnectionString").ConnectionString)
    Dim strSQL As String = "Update MyTable Set (" & typ & num & ") Values (@" & typ & num & ") WHERE personID = " & fid
    Dim cmd As New SqlCommand(strSQL, conn)
    With cmd.Parameters
       .Add(New SqlParameter("@" & typ & num, pname))
    End With
    TestLabel.Text = strSQL & "        " & pname
    cmd.Connection.Open()
    cmd.ExecuteNonQuery()
    cmd.Connection.Close()
   


Here's my test message; first the sql, then the new string to be inserted:

Update MyTable Set (picturename) Values (@pname) WHERE personID = 2       2_adin.jpg  

Here's my error code:

Line 1: Incorrect syntax near '('.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: Line 1: Incorrect syntax near '('.

Source Error:

Line 489:            TestLabel.Text = strSQL & "  " & pname
Line 490:            cmd.Connection.Open()
Line 491:            cmd.ExecuteNonQuery()
Line 492:            cmd.Connection.Close()
Line 493:        End If
 


I could understand it if I'd get an error in VWD Express for using dynamic variables, but they work correctly in the text message so I'm clueless. Any help is deeply appreciated!

Pettrer (VB, Sql Server 2000)