sql - Error While Using "Like' in VB -

i have form takes input user in textbox display ("contains") record/data on grid. however, unable achieve input data thing. have been trying solve while now. dtatbase ms access. else works fine. appreciated.

here code: don't values in form grid whatsoever query.

p.s: beginner :) thanks!

imports system.data.oledb  public class form1      dim dbconnection oledbconnection     dim dbcommand oledbcommand     dim dbdataadapter oledbdataadapter     dim connectstring string = "provider = microsoft.jet.oledb.4.0;" & "data source=atg.mdb"     dim dtatg datatable     dim searchq, sqlstr string      private sub form1_load(byval sender system.object, byval e system.eventargs) handles mybase.load      end sub      private sub button2_click(byval sender system.object, byval e system.eventargs) handles button2.click         dim dtatg new datatable() ''// create new datatable          searchq = textbox1.text         dbdataadapter = new oledbdataadapter         sqlstr = "select * atg term " & """%" & cstr(textbox1.text) & "%"""          dbdataadapter.fill(dtatg)          datagrid1.datasource = dtatg     end sub  end class 

what rdbms using?

select * atg term '% expression %'

don't pass values text boxes directly query strings.

1. you didn't list selection criteria, aka columns, need specify @ least 1 column between select , or use select asterisk did above.
2. in you're clause using asterisks instead of modulo aka percent signs. in sql field wildcard % not *.
3. you're trying build string values text box. unless text box has validation in event enter:

123'; drop table atg;

so rendered string be:

select * atg term '% 123'; drop table atg; %' 

now technically invalid sql, first 2 statements in query, if executed delete table database. solution check form input before pass value sql query , use sql parameters construct query without worrying people passing in malicious statements:

read here oledb samples using sql parameters

passing malicious statements through interfaces cause problems rdmbs via sql known sql injection.