You should not hard code queries into your VB code if you can help it.
if you were using SQL Server I would say that you use Stored Procedures on the database instead of hard coded queries.
by passing parameters to a Stored Procedure from your code and having the database send you information back you are allowing the database to take care of a lot of the security of making sure that no SQL injection occurs, I am not saying that you shouldn't make sure that your input is not sanitized before you send it to your stored procedure.
separate the database from the presentation. let the database handle all the updating and retrieval of information, let your VB.NET application handle all the presentation of that data, and handle the input.