I "think" the year column is actually a keyword that is reserved. You could try
where [year] = blah blah blah
The other important thing to note here is that your code is wide open to SQL Injection attacks. I realize it is only Microsoft Access but if you put this on a shared drive with multiple users, one of your wise ass users could destroy the contents of your database with little effort.
Also, using page level connected database objects like OleDbConnection is very, very bad practice. You are opening, using, closing, and destroying your objects properly.