Really strange error
-
Hiya Peeps,
I'm trying to set up an Intranet at the school. It has an admin section to add / modify / delete records.
So far it adds records but I'm struggling with modifying them.
If I use the code like this:
recset1.Source = "SELECT * FROM events WHERE events_id = 10"
it updates fine but if I try and use an ASP variable:
recset1.Source = "SELECT * FROM events WHERE events_id = " & request("id") & ""
An error occurs:
Microsoft OLE DB Provider for SQL Server error '80040e21'
The requested properties cannot be supported.
Wierd. Any ideas why?
Jk
-
Found it - the field i was requesting from was called events_id instead of id. I WAS REQUESTING A NON EXISTENT FIELD!
Jk
-
Speaking from having done this myself, and having several years experience of such development work, how are you doing the sql debugging/scripting?
-
Not to be combative, but you might want to read about the basics of stored procedures and sql injection BEFORE it hits you.
--
Frank Kalis
Microsoft SQL Server MVP
Webmaster: http://www.insidesql.org/blogs
My blog: http://www.insidesql.org/blogs/frankkalis/[/url] -
that was kind of my line of thinking, Frank, but it'd be useful to know (judging by the quoted lines of statement) whether its been anywhere near Query Analyser.....
-
Sorry, wasn't aware that you've already replied while I was reading and typing.
--
Frank Kalis
Microsoft SQL Server MVP
Webmaster: http://www.insidesql.org/blogs
My blog: http://www.insidesql.org/blogs/frankkalis/[/url] -
hey - no worries!
Kind of surprised that no-one else had picked it up, but there you go. There seems precious few threads on web/sql with this kind of line....
-
Just my added 2 cents...
Or if you choose not to use a Stored Procedure at least use a ADOBB.Command object and parameterize your sql statement. Works Exactly the same as doing with a stored procedure which means you can control the SQL string more effectively against injection attacks and they can only submit valid data for the data type.
I have a few extreme pages going against a view for adhoc style reporting where I build the string parameterized for each option chosen.
But another thing I noticed was you just use Request("obj_name") which is a bad practive. If the page is sent by a form POST use Request.Form, if a QueryString the use Request.QueryString otherwise you open yourself to another attck thru QueryStrings if post is the passed method and you are spending a lot of extra cycles looking thru the entire Request collection that you don't need.
Viewing 8 posts - 1 through 7 (of 7 total)
You must be logged in to reply to this topic. Login to reply