Snitz Forums 2000 - sql statement

Snitz Forums 2000

Username:	Password:
Save Password
Forgot your Password?

All Forums

Community Forums

Code Support: ASP (Non-Forum Related)

sql statement

New Topic

Topic Locked

Printer Friendly

Author

Topic

corneillie
Junior Member

140 Posts

Posted - 24 July 2007 : 14:32:01

Hello,

I have a problem that I cannot solve:

The error I get is:

Microsoft JET Database Engine error '80040e14'

Syntax error (missing operator) in query expression 'E-mail = test@test.be'.

the sql statement I use is:

sqlMainData = "SELECT * FROM bestellingen WHERE E-mail = " & strEmail

strEmail is a variable that comes from the form:

<%
Dim strEmail
strEmail = Request.Form("email")
if strEmail = "" then
response.redirect("form.html")
end if
%>

thx

HuwR
Forum Admin

United Kingdom
20595 Posts

Posted - 24 July 2007 : 15:35:28

sqlMainData = "SELECT * FROM bestellingen WHERE E-mail = '" & strEmail & "'"

corneillie
Junior Member

140 Posts

Posted - 24 July 2007 : 16:18:58

thx

Shaggy
Support Moderator

Ireland
6780 Posts

Posted - 25 July 2007 : 04:07:48

You might want to sanitise the form input before passing it through to an SQL statement.

Search is your friend
“I was having a mildly paranoid day, mostly due to the
fact that the mad priest lady from over the river had
taken to nailing weasels to my front door again.”

Podge
Support Moderator

Ireland
3776 Posts

Posted - 25 July 2007 : 05:10:30

and select only the columns you need i.e.

"SELECT column1, column2 FROM bestellingen WHERE E-mail = '" & strEmail & "'"

Podge.

The Hunger Site - Click to donate free food | My Blog | Snitz 3.4.05 AutoInstall (Beta!)

My Mods: CAPTCHA Mod | GateKeeper Mod
Tutorial: Enable subscriptions on your board

Warning: The post above or below may contain nuts.

Topic

New Topic

Topic Locked

Printer Friendly

Jump To:

Snitz Forums 2000

This page was generated in 0.28 seconds.