Vista - ASP form write to DB issue

Hi,

I don't have much scripting experience and I need some help with a
simple piece of code. Basically, I have a html form with a input field
that posts the input to a ASP page (the ASP page must establish a
connection to a SQL database and write the input from the form to a
table). The content of the ASP page as follows:


' Declaring variables
Dim rest_nme, data_source, con, sql_insert

' Receiving values from Form
rest_nme = Request.Form("rest_nme")

data_source =
"Provider=SQLNCLI;Server=localhost;Database=RMS;Uid=user;Pwd=password;"
sql_insert = "insert into database.dbo.table (rest_nme) values ('" &
rest_nme & "')"

' Creating Connection Object and opening the database
Set con = CreateObject("ADODB.Connection")
con.Open data_source
con.Execute sql_insert

' Done. Close the connection
con.Close
Set con = Nothing

I know for a fact that the form input is passed to the ASP page
correctly (if I post the form to email the value is correct), but the
row thats being written to the SQL DB is empty. From the empty row
thats being written I must assume that the connection string works and
I have no idea where the issue might lie. Any suggestions would be
much appreciated!

You might get an answer here but you'd
probably be better off asking in an ASP
group. This group is just for general VBS.

Do a response.write with the SQL and try running that using whatever tool
comes with the DB.

Tim

<avdvyver@xxxxxx> wrote in message
news:9d138a9a-0386-43d7-9f1c-ad95c7ceedba@xxxxxx

On Nov 24, 2:04*pm, avdvy...@xxxxxx wrote:Try hard coding your sql statement like below and see if the data is
written:

sql_insert = "insert into database.dbo.table (rest_nme) values
('"mydata"')"

Check your quotes - escape double quotes with single quotes as shown
above and below. Also check if you need the entire database.dbo.table
- you might just need table. Below is my exact insert string from an
app I wrote. This was using an access database, so it might be
slightly different.

StrSQL = "INSERT INTO verify ([name], [training], [ip], [user]) VALUES
('" & tName & "','" & tTraining & "','" & tIP & "','" & tUser & "')"

Just keep at it... something will get it clicking.

avdvyver@xxxxxx wrote:"Provider=SQLNCLI;Server=localhost;Database=RMS;Uid=user;Pwd=password;"Change this to:
sql_insert = "insert into database.dbo.table (rest_nme) values (?)"

Create a command object:
Set cmd = CreateObject("ADODB.Command")
cmd.commandtext=sql_insert
cmd.commandtype = 1 '1=adCmdText
set cmd.activeconnection=con
cmd.execute ,rest_nme, 128 '128=adExecuteNoRecords

If you need to pass more than one parameter value, you need to use a
variant array. See this message for more info:

Your use of dynamic sql is leaving you vulnerable to hackers using sql
injection:
http://mvp.unixwiz.net/techtips/sql-injection.html
http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23

See here for a better, more secure way to execute your queries by using
parameter markers (tokens):
http://groups-beta.google.com/group/...e36562fee7804e

Personally, I prefer using stored procedures
http://groups.google.com/group/micro...09dc1701?hl=en


http://groups.google.com/groups?hl=e...tngp13.phx.gbl

http://groups.google.com/groups?hl=e...TNGP11.phx.gbl

http://www.google.com/groups?selm=eE...&output=gplain

http://www.google.com/groups?hl=en&l...TNGP12.phx.gbl

Using Command object:
http://groups-beta.google.com/group/...e36562fee7804e


--
HTH,
Bob Barrows