RUN, don't walk, to your favorite search engine and search on SQL Injection.
Get rid of your concatented sql statements NOW! In short, consider the following
SQL:

"Select * from Employee where EmployeeId = " & txtSearchString.text

This works fine as long as the user puts a valid value into the box. Now
what happens if they enter "1 or 1=1" in the txtsearchstring box? All employee
records will be returned. If we get meaner, we could enter "1 ; Drop Table
Employee". Hopefully you can figure out what will happen now. I've heard
that some security companies have come up with a fully functioning SQL Enterprise
Manager solely using SQL Injection attacks on a vulnerable web application.

As a better alternative, here is an example of a parameterized SQL statement:

Using cn = New SqlConnection(MyConnectionString)
dim cm as as SqlCommand = cn.CreateCommand
cm.CommandType = commandType.Text
cm.CommandText = "Select * from Customers where City = @City"
cm.Parameters.AddWithValue("@City", txtSearchString.text)
dim dr as DataReader = cm.ExecuteReader

From a code standpoint, parametrized SQL behaves much like stored procedures.
The difference is, you aren't defining the procedure on the server, but in
your code. SQL Server will still cache the execution plan on parameterized
queries as long as the parameter list does not change (the parameter values
can change without effecting the cache). Becasue we are parameterizing the
results, entering one of the invalid responses above will not have the same
undesired effects as the server does not see the invalid values as additional
commands to execute, but just values to compare against.

Jim Wooley
http://devauthority.com/blogs/jwooley/default.asp