ASP / SQL Question

[Dthmtlgod]

I can't remember how to send values to my Access DB through an SQL statement

Conn.execute ("INSERT INTO MISSING_IMAGES (SubmitterID, UserFullName, PCN,
ClaimNumber) VALUES ('SubmitterID','UserFullName', 'PCN', 'ClaimNumber')")

Please help.

 

[Ray Costanzo [MVP]]

What do you need help with? Is that not working for you? Do you get an
error of some sort? What seems to be the problem.

Ray at work

 

[Bob Barrows [MVP]]

I can't remember how to send values to my Access DB through an SQL
statement

Conn.execute ("INSERT INTO MISSING_IMAGES (SubmitterID, UserFullName,
PCN, ClaimNumber) VALUES ('SubmitterID','UserFullName', 'PCN',
'ClaimNumber')")

Please help.

Are 'SubmitterID','UserFullName', 'PCN',etc. the actual values you want to
insert? Or are they variable names?

 

[Veign]

I would recommend against using the Execute method as this opens you up for
SQL Injection. Better method is to use a Command Object and the Parameters
collection.

Helper Links:

SQL Injection
www.spidynamics.com/papers/SQLInjectionWhitePaper.pdf

SQL Injection Attacks - Are You Safe?
http://www.sitepoint.com/article/sql-injection-attacks-safe

Protecting Yourself from SQL Injection Attacks:
http://www.4guysfromrolla.com/webtech/061902-1.shtml

 

[Bob Barrows [MVP]]

I would recommend against using the Execute method as this opens you
up for SQL Injection. Better method is to use a Command Object and
the Parameters collection.

Good advice, but I would go a little further to mention that parameters can
be passed without using a Command object, by using the
"procedure-as-connection-method" technique. Same outcome: parameters passed
with no danger of SQL Injection, but much simpler than using the explicit
Command.

Here are some links for this technique as it applies to Access:

http://groups.google.com/groups?hl=...=1&[email protected]

http://groups.google.com/groups?hl=...=1&[email protected]

http://www.google.com/[email protected]&oe=UTF-8&output=gplain

Bob Barrows

 

[Dthmtlgod]

I need to submit the variable not the field name again, my mistake. I
looked at some of my old code.

One question, one of my fields is a Date field, can this be added using the
INSERT command?

 

[Bob Barrows [MVP]]

Yes, but if you use dynamic sql, you will have to remember to delimit the
value properly. For Jet (Access) you need to use # delimiters.

http://groups.google.com/groups?hl=...=1&[email protected]

http://www.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&[email protected]

Bob Barrows

 

[Veign]

Good catch....

I was just passing through and caught this thread. More people need to be
aware of SQL Injections. There are so many websites around that I can get
through the username and password with some SQL Injection techniques...

--
Chris Hanscom - Microsoft MVP (VB)
Veign's Resource Center
http://www.veign.com/vrc_main.asp