Bob
Wed May 16 13:02:28 CDT 2007
bogiecat@myway.com wrote:
> I'm trying to pull data from a form and insert it into sql. This is
> what I have:
>
> <%
> Answer = Request("Value")
Probably nothing to do with your problem, but see:
http://www.aspfaq.com/show.asp?id=2111
>
> pull_rs("INSERT INTO tSurveyResult (Result) VALUES (" & Answer &")")
Again, probably nothing to do with your problem, but you might want to
consider renaming that Result column: "Result" is a reserved keyword and
may be used in a future version of sql. If you don't wish to rename it
(or are unable to), you should probably play it safe and delimit it with
brackets [] when using it in your queries.
Er, what is pull_rs? You are calling it as if it were a function ...
> %>
>
> And the error message I get is
>
> 2147217900 - Line 1: Incorrect syntax near ')'.
>
>
> What am I doing wrong?
To find out, write the sql statement that results from your
concatenation to Response, run the page and look at it. Like this:
dim sql
sql="INSERT INTO tSurveyResult (Result) VALUES (" & Answer &")"
Response.Write sql
If looking at the sql statement doesn't help, try copying it to the
clipboard and running it in SQL Query Analyzer. If all else fails, post
it here.
Further points to consider:
Your use of dynamic sql is leaving you vulnerable to hackers using sql
injection:
http://mvp.unixwiz.net/techtips/sql-injection.html
http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23
See here for a better, more secure way to execute your queries by using
parameter markers:
http://groups-beta.google.com/group/microsoft.public.inetserver.asp.db/msg/72e36562fee7804e
Better yet would be to encapsulate your sql into stored procedures and
pass parameter values to them per this:
http://groups.google.com/group/microsoft.public.inetserver.asp.general/msg/5d3c9d4409dc1701?hl=en
--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.