Problem with handling table insert from ASP page

Jack

Hi,
I am gathering the input values to a form using Request.form method from the
processing page. After all the data is captured, I am building sql statement
out of it. Using a response.write statement, I am generating the output of
the sql statement which I can ran against the table to insert the row.
However, when I am trying to programmatically use the sql statement for the
insert, I am having the following error:

Error Type:
Microsoft JET Database Engine (0x80040E14)
Syntax error in INSERT INTO statement.
/indianland/mainentry_process.asp, line 94

I am attaching the processing code here where line 94 is the following
statement:

conn.execute(strSQL)

I have no idea why this is producing an error. Any help is appreciated.
CODE:


<HTML>
<HEAD>
<META NAME="GENERATOR" Content="Microsoft Visual Studio 6.0">
</HEAD>
<BODY>

<%

ApplicantIntID = Request.Cookies("ApplicantIntID")
Dim l_p_Agency
Dim l_p_lstOffense
Dim l_p_CountTotalOffenses
Dim l_p_CountClearedByArrestOrExceptionalMeans
Dim l_p_CountOffenseReportedBySlec
Dim l_p_CountAlcoholRelated
Dim l_p_CountDrugRelated
Dim l_p_CountOffenseCommittedByJuvenile
Dim l_p_lstMonth
Dim l_p_lstYear

l_AgencyCode = Request.Form("cboAgency")

l_OffenseCode = Request.Form("cboOffense")

l_p_CountTotalOffenses = Request.Form("txt_CountTotalOffenses")

l_p_CountClearedByArrestOrExceptionalMeans =
Request.Form("txt_CountClearedByArrestOrExceptiona lMeans")

l_p_CountOffenseReportedBySlec =
Request.Form("txt_CountOffenseReportedBySlec")

l_p_CountAlcoholRelated = Request.Form("txt_CountAlcoholRelated")

l_p_CountDrugRelated = Request.Form("txt_CountDrugRelated")

l_p_CountOffenseCommittedByJuvenile =
Request.Form("txt_CountOffenseCommittedByJuvenile" )

l_Month = Request.Form("cboMonth")

l_Year = Request.Form("cboYear")

'Now we are to build each row corresponding to each of the entry

strSQL = "INSERT INTO tblAgencyOffenseStats(ApplicantIntID, AgencyID,
OffenseID, CountTotalOffenses,
CountOfOffensesClearedByArrestOrExceptionalMeans,
CountOfOffensesReportedBySLEC, CountOfAlcoholRelatedOffenses,
CountOfDrugRelatedOffenses, CountOfOffensesCommittedByJuvenile, Month, Year)
VALUES ("& ApplicantIntID & ", "& l_AgencyCode &", "& l_OffenseCode &", "&
l_p_CountTotalOffenses &", "& l_p_CountClearedByArrestOrExceptionalMeans &",
"& l_p_CountOffenseReportedBySlec &", "& l_p_CountAlcoholRelated &", "&
l_p_CountDrugRelated &", "& l_p_CountOffenseCommittedByJuvenile &", "&
l_Month &", "& l_year &")"

Response.Write strSQL & " "

conn.execute(strSQL)

Response.Write " "
Response.Write "Your record has been updated." & " "
%>
<A HREF="mainentry.asp?ApplicantIntID=<%=ApplicantInt ID%>">Please click here
for the next submission</A>

</BODY>
</HTML>

Mar 3 '06 #1

Subscribe Post Reply

1785

Mike Brind

Jack wrote:

Hi,
I am gathering the input values to a form using Request.form method from the
processing page. After all the data is captured, I am building sql statement
out of it. Using a response.write statement, I am generating the output of
the sql statement which I can ran against the table to insert the row.
However, when I am trying to programmatically use the sql statement for the
insert, I am having the following error:

Error Type:
Microsoft JET Database Engine (0x80040E14)
Syntax error in INSERT INTO statement.
/indianland/mainentry_process.asp, line 94

I am attaching the processing code here where line 94 is the following
statement:

conn.execute(strSQL)

I have no idea why this is producing an error. Any help is appreciated.
CODE:


<HTML>
<HEAD>
<META NAME="GENERATOR" Content="Microsoft Visual Studio 6.0">
</HEAD>
<BODY>

<%

ApplicantIntID = Request.Cookies("ApplicantIntID")
Dim l_p_Agency
Dim l_p_lstOffense
Dim l_p_CountTotalOffenses
Dim l_p_CountClearedByArrestOrExceptionalMeans
Dim l_p_CountOffenseReportedBySlec
Dim l_p_CountAlcoholRelated
Dim l_p_CountDrugRelated
Dim l_p_CountOffenseCommittedByJuvenile
Dim l_p_lstMonth
Dim l_p_lstYear

l_AgencyCode = Request.Form("cboAgency")

l_OffenseCode = Request.Form("cboOffense")

l_p_CountTotalOffenses = Request.Form("txt_CountTotalOffenses")

l_p_CountClearedByArrestOrExceptionalMeans =
Request.Form("txt_CountClearedByArrestOrExceptiona lMeans")

l_p_CountOffenseReportedBySlec =
Request.Form("txt_CountOffenseReportedBySlec")

l_p_CountAlcoholRelated = Request.Form("txt_CountAlcoholRelated")

l_p_CountDrugRelated = Request.Form("txt_CountDrugRelated")

l_p_CountOffenseCommittedByJuvenile =
Request.Form("txt_CountOffenseCommittedByJuvenile" )

l_Month = Request.Form("cboMonth")

l_Year = Request.Form("cboYear")

'Now we are to build each row corresponding to each of the entry

strSQL = "INSERT INTO tblAgencyOffenseStats(ApplicantIntID, AgencyID,
OffenseID, CountTotalOffenses,
CountOfOffensesClearedByArrestOrExceptionalMeans,
CountOfOffensesReportedBySLEC, CountOfAlcoholRelatedOffenses,
CountOfDrugRelatedOffenses, CountOfOffensesCommittedByJuvenile, Month, Year)
VALUES ("& ApplicantIntID & ", "& l_AgencyCode &", "& l_OffenseCode &", "&
l_p_CountTotalOffenses &", "& l_p_CountClearedByArrestOrExceptionalMeans &",
"& l_p_CountOffenseReportedBySlec &", "& l_p_CountAlcoholRelated &", "&
l_p_CountDrugRelated &", "& l_p_CountOffenseCommittedByJuvenile &", "&
l_Month &", "& l_year &")"

Response.Write strSQL & " "

conn.execute(strSQL)

Response.Write " "
Response.Write "Your record has been updated." & " "
%>
<A HREF="mainentry.asp?ApplicantIntID=<%=ApplicantInt ID%>">Please click here
for the next submission</A>

</BODY>
</HTML>

First of all, ppost the result of response.write(strSQL), and while
people are chewing over that, have a look at Bob's various posts on
using saved parameter queries:

http://groups.google.com/group/micro...UTF-8&oe=UTF-8
http://groups.google.com/group/micro...d322b882a604bd

--
Mike Brind

Mar 3 '06 #2

Roland Hall

"Mike Brind" wrote in message
news:11**********************@j33g2000cwa.googlegr oups.com...
:
: Jack wrote:
: > Hi,
: > I am gathering the input values to a form using Request.form method from
the
: > processing page. After all the data is captured, I am building sql
statement
: > out of it. Using a response.write statement, I am generating the output
of
: > the sql statement which I can ran against the table to insert the row.
: > However, when I am trying to programmatically use the sql statement for
the
: > insert, I am having the following error:
: >
: > Error Type:
: > Microsoft JET Database Engine (0x80040E14)
: > Syntax error in INSERT INTO statement.
: > /indianland/mainentry_process.asp, line 94
: >
: > I am attaching the processing code here where line 94 is the following
: > statement:
: >
: > conn.execute(strSQL)
: >
: > I have no idea why this is producing an error. Any help is appreciated.
: > CODE:
: >
: >
: > 
: > 
: > <HTML>
: > <HEAD>
: > <META NAME="GENERATOR" Content="Microsoft Visual Studio 6.0">
: > </HEAD>
: > <BODY>
: >
: > <%
: >
: > ApplicantIntID = Request.Cookies("ApplicantIntID")
: >
: >
: > Dim l_p_Agency
: > Dim l_p_lstOffense
: > Dim l_p_CountTotalOffenses
: > Dim l_p_CountClearedByArrestOrExceptionalMeans
: > Dim l_p_CountOffenseReportedBySlec
: > Dim l_p_CountAlcoholRelated
: > Dim l_p_CountDrugRelated
: > Dim l_p_CountOffenseCommittedByJuvenile
: > Dim l_p_lstMonth
: > Dim l_p_lstYear
: >
: >
: >
: >
: > l_AgencyCode = Request.Form("cboAgency")
: >
: > l_OffenseCode = Request.Form("cboOffense")
: >
: > l_p_CountTotalOffenses = Request.Form("txt_CountTotalOffenses")
: >
: > l_p_CountClearedByArrestOrExceptionalMeans =
: > Request.Form("txt_CountClearedByArrestOrExceptiona lMeans")
: >
: > l_p_CountOffenseReportedBySlec =
: > Request.Form("txt_CountOffenseReportedBySlec")
: >
: > l_p_CountAlcoholRelated = Request.Form("txt_CountAlcoholRelated")
: >
: > l_p_CountDrugRelated = Request.Form("txt_CountDrugRelated")
: >
: > l_p_CountOffenseCommittedByJuvenile =
: > Request.Form("txt_CountOffenseCommittedByJuvenile" )
: >
: > l_Month = Request.Form("cboMonth")
: >
: > l_Year = Request.Form("cboYear")
: >
: > 'Now we are to build each row corresponding to each of the entry
: >
: > strSQL = "INSERT INTO tblAgencyOffenseStats(ApplicantIntID,
AgencyID,
: > OffenseID, CountTotalOffenses,
: > CountOfOffensesClearedByArrestOrExceptionalMeans,
: > CountOfOffensesReportedBySLEC, CountOfAlcoholRelatedOffenses,
: > CountOfDrugRelatedOffenses, CountOfOffensesCommittedByJuvenile, Month,
Year)
: > VALUES ("& ApplicantIntID & ", "& l_AgencyCode &", "& l_OffenseCode &",
"&
: > l_p_CountTotalOffenses &", "& l_p_CountClearedByArrestOrExceptionalMeans
&",
: > "& l_p_CountOffenseReportedBySlec &", "& l_p_CountAlcoholRelated &", "&
: > l_p_CountDrugRelated &", "& l_p_CountOffenseCommittedByJuvenile &", "&
: > l_Month &", "& l_year &")"
: >
: > Response.Write strSQL & " "
: >
: > conn.execute(strSQL)
: >
: > Response.Write " "
: > Response.Write "Your record has been updated." & " "
: > %>
: > <A HREF="mainentry.asp?ApplicantIntID=<%=ApplicantInt ID%>">Please click
here
: > for the next submission</A>
: >
: > </BODY>
: > </HTML>
:
: First of all, ppost the result of response.write(strSQL), and while
: people are chewing over that, have a look at Bob's various posts on
: using saved parameter queries:
:
:
http://groups.google.com/group/micro...UTF-8&oe=UTF-8
:
http://groups.google.com/group/micro...d322b882a604bd

Translation: SQL injection

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp

Mar 4 '06 #3

Mike Brind

Roland Hall wrote:

"Mike Brind" wrote in message
news:11**********************@j33g2000cwa.googlegr oups.com...
:
: Jack wrote:
: > Hi,
: > I am gathering the input values to a form using Request.form method from
the
: > processing page. After all the data is captured, I am building sql
statement
: > out of it. Using a response.write statement, I am generating the output
of
: > the sql statement which I can ran against the table to insert the row.
: > However, when I am trying to programmatically use the sql statement for
the
: > insert, I am having the following error:
: >
: > Error Type:
: > Microsoft JET Database Engine (0x80040E14)
: > Syntax error in INSERT INTO statement.
: > /indianland/mainentry_process.asp, line 94 :
: First of all, ppost the result of response.write(strSQL), and while
: people are chewing over that, have a look at Bob's various posts on
: using saved parameter queries:
:
:
http://groups.google.com/group/micro...UTF-8&oe=UTF-8
:
http://groups.google.com/group/micro...d322b882a604bd

Translation: SQL injection

--

Partly, but I've found that since I started taking Bob's recommendation
on saved parameter queries, I've pretty much eliminated Syntax error in
INSERT INTO statement errors.

--
Mike Brind

Mar 6 '06 #4

Jack

Thanks to both you guys for all the help. However, I got this problem solved.
All I had to do
was put [] between the month as well as year in the sql syntax. Since these
are reserved words with the above approach the problem got solved. Somebody
from a different forum suggested me this solution and it indeed did work. In
any event, thanks to both of you. Regards.

"Mike Brind" wrote:

Roland Hall wrote:
"Mike Brind" wrote in message
news:11**********************@j33g2000cwa.googlegr oups.com...
:
: Jack wrote:
: > Hi,
: > I am gathering the input values to a form using Request.form method from
the
: > processing page. After all the data is captured, I am building sql
statement
: > out of it. Using a response.write statement, I am generating the output
of
: > the sql statement which I can ran against the table to insert the row.
: > However, when I am trying to programmatically use the sql statement for
the
: > insert, I am having the following error:
: >
: > Error Type:
: > Microsoft JET Database Engine (0x80040E14)
: > Syntax error in INSERT INTO statement.
: > /indianland/mainentry_process.asp, line 94

:
: First of all, ppost the result of response.write(strSQL), and while
: people are chewing over that, have a look at Bob's various posts on
: using saved parameter queries:
:
:
http://groups.google.com/group/micro...UTF-8&oe=UTF-8
:
http://groups.google.com/group/micro...d322b882a604bd

Translation: SQL injection

--

Partly, but I've found that since I started taking Bob's recommendation
on saved parameter queries, I've pretty much eliminated Syntax error in
INSERT INTO statement errors.

--
Mike Brind

Mar 7 '06 #5

Mike Brind

Jack wrote:

Thanks to both you guys for all the help. However, I got this problem solved.
All I had to do
was put [] between the month as well as year in the sql syntax. Since these
are reserved words with the above approach the problem got solved. Somebody
from a different forum suggested me this solution and it indeed did work. In
any event, thanks to both of you. Regards.

A good reason to avoid using reserved words, or spaces in field names.
Here's a link you might want to bookmark for future reference:

http://www.aspfaq.com/show.asp?id=2080

--
Mike Brind

Mar 7 '06 #6

Roland Hall

: > Translation: SQL injection
:
: Partly, but I've found that since I started taking Bob's recommendation
: on saved parameter queries, I've pretty much eliminated Syntax error in
: INSERT INTO statement errors.

Bob is pretty handy. I tried to put him on retainer but he said he had
enough money. (O:=

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp

Mar 8 '06 #7

Mike Brind

Roland Hall wrote:

: > Translation: SQL injection
:
: Partly, but I've found that since I started taking Bob's recommendation
: on saved parameter queries, I've pretty much eliminated Syntax error in
: INSERT INTO statement errors.

Bob is pretty handy. I tried to put him on retainer but he said he had
enough money. (O:=

I already have him on free retainer in this group, but don't tell
him.....

;-)

--
Mike Brind

Mar 8 '06 #8

Bob Barrows [MVP]

Roland Hall wrote:

Translation: SQL injection

Partly, but I've found that since I started taking Bob's
recommendation on saved parameter queries, I've pretty much
eliminated Syntax error in INSERT INTO statement errors.

Bob is pretty handy. I tried to put him on retainer but he said he
had enough money. (O:=

LOL
I'm not sure that was exactly what I said ...
--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

Mar 8 '06 #9

Bob Barrows [MVP]

Mike Brind wrote:

Roland Hall wrote:
Translation: SQL injection

Partly, but I've found that since I started taking Bob's
recommendation on saved parameter queries, I've pretty much
eliminated Syntax error in INSERT INTO statement errors.

Bob is pretty handy. I tried to put him on retainer but he said he
had enough money. (O:=

I already have him on free retainer in this group, but don't tell
him.....

;-)

Thanks guys, but I've got to stop reading this stuff before somebody notices
my head swelling.

Besides, there are several people in these groups that I've learned from ...
including Roland.

Enough of the mutual admiration society ... back to work.

--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.

Mar 8 '06 #10

Similar topics

Form handling with PHP

by: Glyphman | last post by:

I have a bunch of pages with long forms, with lots of input types-text, radios, textareas, and the debugging process has become overwhelming. What I need to happen is to make sure that 1. Every...

PHP

Query problem...

by: Net Virtual Mailing Lists | last post by:

Hello, I have 3 tables which are joined that I need to create a summation for and I just cannot get this to work. Here's an example: CREATE table1 ( id1 INTEGER, title1 VARCHAR

PostgreSQL Database

FormView, SqlDataSource and handling exceptions

by: Rob | last post by:

Hey all, So.. a simple FormView/SqlDataSource to handle inserting records into a table. The table has a primary key that the user enters (eg DiscountCode). If the user enters a duplicate the...

ASP.NET

inserting into two tables and transaction problem

by: Habib | last post by:

CREATE PROCEDURE SimpleInsert ( @custname custname_type, @carname carname_type) AS BEGIN TRANSACTION INSERT Customers (CustName) VALUES (@custname)

Microsoft SQL Server

An OleDbParameter with ParameterName '@ID' is not contained by thisOleDbParameterCollection problem

by: DC | last post by:

The Code <%@ import namespace="System" %> <%@ import namespace="System.Web" %> <%@ import namespace="System.Web.UI" %> <%@ import namespace="System.Web.UI.HtmlControls" %> <%@ import...

ASP.NET

SqlDataSource Error Handling

by: dhyder | last post by:

I'm working on an admin page for a SQL Server 05 db. The page is in ASP.NET 2.0/C#. The db has multiple tables with foreign keys/constraints. I have multiple SqlDataSources and GridViews, which...

.NET Framework

GridView on Delete Method problem

by: Ed Dror | last post by:

Hi there, I'm using ASP.NET 2.0 and SQL Server 2005 with VS 2005 Pro. I have a Price page (my website require login) with GridView with the following columns PriceID, Amount, Approved,...

ASP.NET

strange update problem .net

by: sirdavethebrave | last post by:

Hi guys - I have written a form, and a stored procedure to update the said form. It really is as simple as that. A user can go into the form, update some fields and hit the update button to...

.NET Framework

dropdown problem

by: coolv | last post by:

Hello I have problem in my page that the dropdown box is not displaying data according to selection of first dropdown.Please help me. Below is my code. thanks.............. <?php ...

PHP

Migrating Website to Cloud - Emmanuel Katto

by: emmanuelkatto | last post by:

Hi All, I am Emmanuel katto from Uganda. I want to ask what challenges you've faced while migrating a website to cloud. Please let me know. Thanks! Emmanuel

General

Navigating the Data Structures and Algorithms (DSA)

by: BarryA | last post by:

What are the essential steps and strategies outlined in the Data Structures and Algorithms (DSA) roadmap for aspiring data scientists? How can individuals effectively utilize this roadmap to progress...

Algorithms / Advanced Math

How to build RAID in BIOS?

by: Hystou | last post by:

There are some requirements for setting up RAID: 1. The motherboard and BIOS support RAID configuration. 2. The motherboard has 2 or more available SATA protocol SSD/HDD slots (including MSATA, M.2...

Computer Hardware

Changing the language in Windows 10

by: Hystou | last post by:

Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...

Windows Server

Problem With Comparison Operator <=> in G++

by: Oralloy | last post by:

Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...

C / C++

Maximizing Business Potential: The Nexus of Website Design and Digital Marketing

by: jinu1996 | last post by:

In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...

Online Marketing

The easy way to turn off automatic updates for Windows 10/11

by: Hystou | last post by:

Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows...

Windows Server

Discussion: How does Zigbee compare with other wireless protocols in smart home applications?

by: tracyyun | last post by:

Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...

General

AI Job Threat for Devs

by: agi2029 | last post by:

Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing,...

Career Advice