ASP.NET 语法错误问题， If cmd.ExecuteNonQuery() ，急啊……

Question

在做数据库更新数据的时候提示：
'.23' 附近有语法错误。
说明: 执行当前 Web 请求期间，出现未处理的异常。请检查堆栈跟踪信息，以了解有关该错误以及代码中导致错误的出处的详细信息。

异常详细信息: System.Data.SqlClient.SqlException: '.23' 附近有语法错误。

源错误:

行 64: Dim cmd As SqlClient.SqlCommand
行 65: cmd = New SqlClient.SqlCommand(cmdstr, conn)
行 66: If cmd.ExecuteNonQuery() Then **********
行 67: Label1.Text = "修改成功"
行 68: Else

我的代码如下：
Protected Sub DetailsView1_ItemUpdating(ByVal sender As Object, ByVal e As System.Web.UI.WebControls.DetailsViewUpdateEventArgs)
Dim txtbox As TextBox = (DetailsView1.Rows(0).Cells(1).Controls(0))
Dim 学号 As String = txtbox.Text.Trim()
txtbox = (DetailsView1.Rows(1).Cells(1).Controls(0))
Dim 姓名 As String = txtbox.Text.Trim()
txtbox = (DetailsView1.Rows(2).Cells(1).Controls(0))
Dim 性别 As String = txtbox.Text.Trim()
txtbox = (DetailsView1.Rows(3).Cells(1).Controls(0))
Dim 籍贯 As String = txtbox.Text.Trim()
txtbox = (DetailsView1.Rows(4).Cells(1).Controls(0))
Dim 出生年月 As String = txtbox.Text.Trim()
txtbox = (DetailsView1.Rows(5).Cells(1).Controls(0))
Dim 班级号 As String = txtbox.Text.Trim()
txtbox = (DetailsView1.Rows(6).Cells(1).Controls(0))
Dim 系别 As String = txtbox.Text.Trim()
txtbox = (DetailsView1.Rows(7).Cells(1).Controls(0))
Dim 专业 As String = txtbox.Text.Trim()
Dim conn As SqlClient.SqlConnection
conn = New SqlClient.SqlConnection("server=WIN-OBR0R3P88AI\SQLEXPRESS;integrated security=true;user id=sa;password=qwer1234__;database=StuInManDB")
conn.Open()
Dim cmdstr As String = "update 学生信息 set 学号=" + 学号 + ",姓名=" + 姓名 + ",性别=" + 性别 + ",出生年月=" + 出生年月 + ",籍贯=" + 籍贯 + ",班级号=" + 班级号 + ",系别=" + 系别 + ",专业=" + 专业 + ""
"where 学号='" + DetailsView1.DataKey.Value.ToString().Trim() + "'"
Dim cmd As SqlClient.SqlCommand
cmd = New SqlClient.SqlCommand(cmdstr, conn)
If cmd.ExecuteNonQuery() Then
Label1.Text = "修改成功"
Else
Label1.Text = "修改操作失败"
End If
conn.Close()
DetailsView1.ChangeMode(DetailsViewMode.ReadOnly)
bind(TextBox1.Text.Trim())
End Sub

请各位 大神指教啊~~~

Answer 1

Dim cmdstr As String = "update 学生信息 set 学号=" + 学号 + ",姓名=" + 姓名 + ",性别=" + 性别 + ",出生年月=" + 出生年月 + ",籍贯=" + 籍贯 + ",班级号=" + 班级号 + ",系别=" + 系别 + ",专业=" + 专业 + ""

可能是这句的问题，只要是存的char型或varchar型的，在写的时候一律应该写成：
Dim cmdstr As String = "update 学生信息 set 学号=‘“+学号+”’,姓名='"+姓名+"',.................
否则会以为是数值型