ช่วยดู Syntax error in UPDATE statement. ของ Login Form ทีครับ

UPDATE User_Login SET password = @pass WHERE user_id = @id

sql = "select * from User_Login WHERE user_id ='" & TextBox1.Text & "' AND password = '" & TextBox2.Text & "'"

Imports System.Data
Imports System.Data.OleDb
Public Class frmLogin
    Private _dataset As DataSet
    Private _conn As OleDbConnection
    Private _conn1 As OleDbConnection
    Private _cmd As OleDbCommand
    Private _cmd1 As OleDbCommand
    Private _adapter As OleDbDataAdapter
    Dim ChangePass As Boolean = False

    Private Sub cmdLogin_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles cmdLogin.Click
        _conn = New OleDbConnection(_conStr)
        _conn.Open()

        Dim sql As String
        sql = "select * from User_Login WHERE user_id ='" & txtUsername.Text & "'" & _
        "AND password = '" & txtPassword.Text & "'"
        Dim _cmd As New OleDbCommand(sql, _conn)

        _dataset = New DataSet()

        Dim _adapter As New OleDbDataAdapter(_cmd)

        _adapter.Fill(_dataset, "login")
        If _dataset.Tables("login").Rows.Count <= 0 Then
            MessageBox.Show("User ID and Password ผิดพลาด", "กรุณาตรวจสอบ", MessageBoxButtons.OK, MessageBoxIcon.Error)
            txtUsername.Text = Nothing
            txtPassword.Text = Nothing
            focustext()
        Else
            frmMain.Show()
            Me.Hide()
        End If
        _conn.Close()
    End Sub

    Private Sub cmdCancel_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles cmdCancel.Click
        Me.Close()
    End Sub
    Private Sub focustext()
        txtUsername.Focus()
        txtUsername.SelectAll()
    End Sub

    Private Sub frmLogin_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        

        Me.Height = 292


    End Sub

    Private Sub cmdChange_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles cmdChange.Click
        ChangePass = Not ChangePass
        If ChangePass = True Then
            Me.Height = 535
            Me.Width = 400
            TextBox1.Focus()
            Panel1.Visible = False
        Else
            Me.Height = 292
            Me.Width = 616
            Panel1.Visible = True
            txtUsername.Focus()
        End If

    End Sub

    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        _conn = New OleDbConnection(_conStr)
        _conn.Open()
        Dim sqlSave As String

        Dim sql As String
        sql = "select * from User_Login WHERE user_id ='" & TextBox1.Text & "' AND password = '" & TextBox2.Text & "'"
        Dim _cmd As New OleDbCommand(sql, _conn)

        _dataset = New DataSet()

        Dim _adapter As New OleDbDataAdapter(_cmd)

        _adapter.Fill(_dataset, "login")

        If _dataset.Tables("login").Rows.Count <= 0 Then
            MessageBox.Show("User ID and Password ผิดพลาด", "กรุณาตรวจสอบ", MessageBoxButtons.OK, MessageBoxIcon.Error)
            TextBox1.SelectAll()
        Else
            If TextBox3.Text = TextBox4.Text Then

                sql.Remove(0, sql.Length)
                sql = "UPDATE User_Login SET password = @pass WHERE user_id = @id"
                sqlSave = sql.ToString
                _cmd = New OleDbCommand(sql, _conn)
                With _conn
                    _cmd.CommandText = sqlSave
                    _cmd.CommandType = CommandType.Text
                    _cmd.Parameters.Clear()
                    _cmd.Parameters.Add("id", OleDbType.Char).Value = TextBox1.Text
                    _cmd.Parameters.Add("pass", OleDbType.Char).Value = TextBox3.Text
                    _cmd.ExecuteNonQuery()
                End With
                TextBox1.Text = ""
                TextBox2.Text = ""
                TextBox3.Text = ""
                TextBox4.Text = ""
            Else
                MessageBox.Show("กรุณาตรวจสอบ  Password ใหม่อีกครั้งคะ")
                TextBox3.SelectAll()
            End If
        End If
        _conn.Close()
    End Sub
End Class

Try
                Dim sql As String
                sql = "SELECT * FROM User_Login WHERE user_id = '" & TextBox1.Text & "'AND password = '" & TextBox2.Text & "'"
                Dim dr As OleDbDataReader
                Dim com As OleDbCommand
                com = New OleDbCommand()
                With com
                    .CommandType = CommandType.Text
                    .CommandText = sql
                    .Connection = Conn
                    .Parameters.Clear()
                    dr = .ExecuteReader()
                    If dr.HasRows Then
                            MessageBox.Show("User ID and Password ผิดพลาด", "กรุณาตรวจสอบ", MessageBoxButtons.OK, MessageBoxIcon.Error)
                            TextBox1.SelectAll()
                    Else
                        If TextBox3.Text = TextBox4.Text Then
                            dim sql as string
                            sql = "UPDATE User_Login SET password = '" & TextBox3.Text & "' WHERE user_id = '" & TextBox1.Text & "'"
                            dim dc as New OleDbCommand(sql, _conn)
                            _cmd.ExecuteNonQuery()
                            TextBox1.Text = ""
                            TextBox2.Text = ""
                            TextBox3.Text = ""
                            TextBox4.Text = ""
                        Else
                            MessageBox.Show("กรุณาตรวจสอบ Password ใหม่อีกครั้งคะ")
                       End If
                    End If
                End With
            Catch ex As Exception
                MessageBox.Show(ex.Message, "การตรวจสอบ", MessageBoxButtons.OK, MessageBoxIcon.Warning)
            End Try