title: What is a simple example of using prepared statements in vb net using Provider=Microsoft.Jet.OLEDB.4.0
body: <p>Hallo good people of Stack overflow.
  For some reason i want to keep working with ms Access as the database using vb net.</p>
  
  <p>My code works well but only if i work directly with user inputs. Which makes my system prone to sql injections.</p>
  
  <p>I have seen some examples on google that show use binding of parameters in prepared statements using vbn.et. </p>
  
  <p>Unfortunately those examples do not support "Provider" key word in my connection string for ms Access table.</p>
  
  <p>Can someone who understands this help me modify my vb code below to work with binding of parameters using Provider=Microsoft.Jet.OLEDB.4.0 as connection string? </p>
  
  <p>I want to avoid saying "where password =  " &amp; supplier_password
  but say something like "where password = @supplier_password "
  and later provide the supplied password text. </p>
  
  <p>Here is my vb net code.</p>
  
  <pre><code>    Private Sub test_password()
  
  
      Dim myConnection As OleDbConnection = New OleDbConnection
      myConnection.ConnectionString = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source =C:\books\author.mdb"
  
      Dim counter As Int16
  
      myConnection.Open()
      Dim str As String
      str = "SELECT * FROM users where password =  '" &amp; pass.Text &amp; "'"
  
  
      Dim cmd As OleDbCommand = New OleDbCommand(str, myConnection)
  
      counter = cmd.ExecuteScalar
      myConnection.Close()
  
      If counter &gt; 0 Then
          MsgBox("password was found")
      Else
          MsgBox("password was NOT found")
  
      End If
  
  End Sub
  </code></pre>
  
  <p>I have used the appropriate</p>
  
  <pre><code>          Imports System.Data.OleDb
            Imports System.Data.SqlClient
  </code></pre>
  
  <p>Many thanks</p>