command error *incorrect syntax near ','* - sql-server-2008-r2

Question

Dim Query As String
Dim con As SqlConnection = New SqlConnection("Data Source=.\SQLEXPRESS;Initial Catalog=Minimarket;Integrated Security=True")
Query = "INSERT INTO Barang(kode_bar,kode_kat,nama_bar,satuan, hbeli, hjual, stok, expired)VALUES("
Query = Query + txtkodebar.Text + ",'" + cmbkodekat.Text + "','" + txtnamabar.Text + "','" + txtsatuan.Text + "','" + txthbeli.Text + "','" + txthjual.Text + "','" + txtstok.Text + "','" + Format(dtpex.Text, "yyyy-MM-dd HH:mm:ss") + "'"
con.Open()
Dim cmd As SqlCommand = New SqlCommand(Query, con)
Dim i As Integer = cmd.ExecuteNonQuery()
If (i > 0) Then
MessageBox.Show("Data berhasil disimpan")
Else
MessageBox.Show("Data gagal disimpan")
End If
con.Close()
*there is anyone can help me ? when i press button save there is error incorrect syntax near ',' in cmd.executenonquery . what i must doing now ? i fell give up :'( *

Answer 1

The reason you are getting that error is this part of your query:
Query = Query + txtkodebar.Text + ",'"
This results in no quotes around txtkodebar.Text. You could fix this by changing it to this:
Query = Query + "'" + txtkodebar.Text + "','"
but a far better way to fix this would be to use parameterized queries, which would not only make this query much less prone to errors, it also eliminates a very bad security hole you have here. What would happen if someone passed "dummy','2015-01-01');DROP DATABASE;" into txtstok.Text?

Answer 2

You are missing a space between expired) and VALUES, you are also missing quotes around txtkodebar.Text, see corrected codebelow:
Dim Query As String
Dim con As SqlConnection = New SqlConnection("Data Source=.\SQLEXPRESS;Initial Catalog=Minimarket;Integrated Security=True")
Query = "INSERT INTO Barang(kode_bar,kode_kat,nama_bar,satuan, hbeli, hjual, stok, expired) VALUES("
Query = Query + "'" + txtkodebar.Text + "','" + cmbkodekat.Text + "','" + txtnamabar.Text + "','" + txtsatuan.Text + "','" + txthbeli.Text + "','" + txthjual.Text + "','" + txtstok.Text + "','" + Format(dtpex.Text, "yyyy-MM-dd HH:mm:ss") + "')"
con.Open()
Dim cmd As SqlCommand = New SqlCommand(Query, con)
Dim i As Integer = cmd.ExecuteNonQuery()
If (i > 0) Then
MessageBox.Show("Data berhasil disimpan")
Else
MessageBox.Show("Data gagal disimpan")
End If
con.Close()
As stated by #GarethD, you should also read upon parametrised queries, as your current query is vulnerable to SQL injection.

Answer 3

The chances are you have something like O'shea in one of your text boxes, which means that because you are using string concatenation to build your query string rather than parameters you end up with an incorrect string.
If you switch to using proper parameterised queries, you will remove the chances of this happening, and will send a properly formatted SQL Statement to the server:
Dim Query As String
Query = "INSERT INTO Barang(kode_bar,kode_kat,nama_bar,satuan, hbeli, hjual, stok, expired)" & _
"VALUES(#kode_bar,#kode_kat,#nama_bar,#satuan, #hbeli, #hjual, #stok, #expired)"
Using conn As New SqlConnection("Data Source=.\SQLEXPRESS;Initial Catalog=Minimarket;Integrated Security=True")
Using cmd As New SqlCommand(Query, conn)
cmd.Parameters.Add("#kode_bar", SqlDbType.Int).Value = txtkodebar.Text
cmd.Parameters.Add("#kode_kat", SqlDbType.VarChar, 50).Value = cmbkodekat.Text
cmd.Parameters.Add("#nama_bar", SqlDbType.VarChar, 50).Value = txtnamabar.Text
cmd.Parameters.Add("#satuan", SqlDbType.VarChar, 50).Value = txtsatuan.Text
cmd.Parameters.Add("#hbeli", SqlDbType.VarChar, 50).Value = txthbeli.Text
cmd.Parameters.Add("#hjual", SqlDbType.VarChar, 50).Value = txthjual.Text
cmd.Parameters.Add("#stok", SqlDbType.VarChar, 50).Value = txtstok.Text
cmd.Parameters.Add("#expired", SqlDbType.DateTime).Value = DateTime.ParseExact(dtpex.Text, "yyyy-MM-dd HH:mm:ss", Nothing)
conn.Open()
Dim i As Integer = cmd.ExecuteNonQuery()
If (i > 0) Then
MessageBox.Show("Data berhasil disimpan")
Else
MessageBox.Show("Data gagal disimpan")
End If
End Using
End Using
I have had to guess at your data types, but it should be fairly clear how to switch between different types. It is also about 5 years since I wrote anything in VB.NET so please forgive any syntax errors.