Select variable "column name"

I'm having this code in VBscript and I want to select a column name
which is variable.

<%@Language="VBScript"%>

<%

Link = Request.QueryString("link")

oRS.Open "SELECT 'Link' FROM snowzone", oConn, 2, 3

%>

How should the SELECT statement be written correctly?

Munsifali
Wed Oct 22 06:21:21 CDT 2003

Dim strLink: strLink - Request.QueryString("Link")
Dim strSQL: strSQL = "SELECT " & strLink & " FROM snowzone"

Call oRs.Open(strSQL, oConn, 2, 3)

This should work. However, you should exercise caution when using this
method. User input cannot always be trusted, and a malicious user could
easily modify the querystring to cause a lot of damage.

You could secure this a little by limiting the column name to one word, no
spaces, no apostrophes, etc. Eg.

Function SafeColumnName(strColumnName)
Dim strReturn: strReturn = strColumnName
strReturn = Replace(strReturn, "'", "") 'Remove apostrophes
strReturn = Replace(strReturn, " ", "") 'Remove spaces
SafeColumnName = strReturn
End Function

Dim strLink: strLink - SafeColumnName(Request.QueryString("Link"))
Dim strSQL: strSQL = "SELECT " & strLink & " FROM snowzone"

On Error Resume Next

Call oRs.Open(strSQL, oConn, 2, 3)

If (Err.Number <> 0) Then
Response.Write("An error occured when trying to open the recordset.
Specified column may be incorrect<br>")
Response.Write("Hit back in your browser to return to the last page")
Response.End
End If

On Error GoTo 0

...code continues here.


Hope this helps,

Mun




"corrie" <corrieknor@hotmail.com> wrote in message
news:3815b325.0310220018.57506dde@posting.google.com...
> I'm having this code in VBscript and I want to select a column name
> which is variable.
>
> <%@Language="VBScript"%>
>
> <%
>
> Link = Request.QueryString("link")
>
> oRS.Open "SELECT 'Link' FROM snowzone", oConn, 2, 3
>
> %>
>
> How should the SELECT statement be written correctly?