asp problem

[^MisterJingo^]

Hi all,
I've been asked to take a look at some asp code and am having trouble
finding where the problem lies.
The asp app itself contains a link to a second page, passing some
parameters on the query string. These parameters are used to stream a
file for downloading. This all works fine.
Just before stream occurs, I need to log the passed parameters into a
database. THis is done by calling the following function:

sub saveClipInfo(ca tegory,no,clipM ode)
dateNow = year(now)&"-"&month(now )&"-"&day(now)& " "&time()
sql = "INSERT INTO tbl_podcasts
(category,clipN o,userID,forena me,surname,stud entYear,clipMod e,dateNow)
VALUES ('"&category&"' ,"&no&", '"&session("use rID")&"',
'"&session("for ename")&"', '"&session("sur name")&"',
"&right(trim(se ssion("sYear")) ,1)&", '"&clipMode& "', '"&dateNow&" ')"
conn.execute(sq l)
end sub

Even though the paramters are being passed correctly, nothing is added
to the database. To make the problem more confusing, this function is
used elsewhere and works correctly. So it seems to be a problem with
the stream page?

Any help would be appreciated.

[Bob Barrows [MVP]]

^MisterJingo^ wrote:

Hi all,
I've been asked to take a look at some asp code and am having trouble
finding where the problem lies.
The asp app itself contains a link to a second page, passing some
parameters on the query string. These parameters are used to stream a
file for downloading. This all works fine.
Just before stream occurs, I need to log the passed parameters into a
database.

What database? Type and version please. This information is alomostalways
relevant when asking a database-related question, and is definitely relevant
in this case.

THis is done by calling the following function:

sub saveClipInfo(ca tegory,no,clipM ode)
dateNow = year(now)&"-"&month(now )&"-"&day(now)& " "&time()
sql = "INSERT INTO tbl_podcasts
(category,clipN o,userID,forena me,surname,stud entYear,clipMod e,dateNow)
VALUES ('"&category&"' ,"&no&", '"&session("use rID")&"',
'"&session("for ename")&"', '"&session("sur name")&"',
"&right(trim(se ssion("sYear")) ,1)&", '"&clipMode& "', '"&dateNow&" ')"

For debugging purposes, put these statements here:

Response.Write sql
Response.End

Run the page and make sure the sql statement is what you intend it to be.

conn.execute(sq l)

Is "conn" defined somewhere? Do you have "On Error Resume Next" somewhere
masking errors?

Further points to consider:
Your use of dynamic sql is leaving you vulnerable to hackers using sql
injection:
http://mvp.unixwiz.net/techtips/sql-injection.html
http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23

See here for a better, more secure way to execute your queries by using
parameter markers:
http://groups-beta.google.com/group/...e36562fee7804e

--
Microsoft MVP - ASP/ASP.NET
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"