SQL update

Kan man ikke dette ???

<!-- #include file=\"open_connection.asp\" -->
<%
dim nr, navn, email, password

nr      = request.form(\"nr\")
navn    = request.form(\"navn\")
email    = request.form(\"email\")
password = request.form(\"password\")


SQL =\"UPDATE staff (email, password, navn)VALUES\"
SQL = SQL& \"(\'\"&email&\"\',\'\"&password&\"\',\'\"&navn&\"\')WHERE\"
SQL = SQL& \"nr=\" &nr
Con.Execute(SQL)

Response.redirect \"admin.asp?indstillinger=1\"
%>
<!-- #include file=\"close_connection.asp\" -->


Jeg får denne fejl

Microsoft OLE DB Provider for ODBC Drivers error \'80040e14\'

[Microsoft][ODBC Microsoft Access 97 Driver] Syntax error in UPDATE statement.

/dm99516/wwwroot/myMonitor/files/admin_action_edit_user.asp, line 14