Create Variable to add into SQL Statement?

If you want to access a specific row, then you should really be using ID numbers.

If you havent already, create a field in the table called "Row_ID" and make it an autonumber (i havent used access in years so dont remember exactly what its called)

You can then pass the Row_ID number around to specify specific records.

Also I would recommend against the "like" statement, as this is ment to allow you do close matchs eg

if you have "where field like 'A%'" then it will find all rows that the field starts with the letter A
the % is a wild card, so you could do " '%A%' " to find all containing A or " '%A' " all ending in A

what you should be doing is:

SELECT * FROM blog WHERE serial_number = '"&request.querystring("serialNum")&"'

And I would recommend taking the direct request out like so:

Dim strSerialNumber strSerialNumber = request.querystring("serialNum") SELECT * FROM blog WHERE serial_number = '"& strSerialNumber &"'

If you use the Row_ID then I would do the following, which will help protect against SQL Injection Attacks:

Dim intSerialID intSerialID = Request.Querystring("SID") if isNumber(intSerialID) then inSerialID = clng(intSerialID) else intSerialID = 0 SELECT * FROM blog WHERE Row_ID = "& intSerialID &"

This will make sure that intSerialID will always be a number

I am afraid I do not know how your database is structured so I do not know the answer.

If your database is structured like this (which I recommended above)

Row_ID | Customer   | Serial Number ----------|---------------|------------------------   1         | John          | WER-TYU-IOP   2         | Mr Smith   | ASD-FGH-JKL

Then you will be able to get the Serial Number by using the Row_ID, rather than the Serial Number directly.
As I said, this would make your SQL statements far more secure from hacking attempts.

If your table has "id" then use that where I have used "Row_ID"

How is your database structured, is the "main page" you mention running off the same Serial Number table as the results page?

If so you will need to change the link to:

<a href="results.asp?SID=<%=rs("id")%>"><%=rs("serial_number")%></a>

If not, you will either need to restructure your database (store the "id" from the serial number table in which ever table is displayed on the "main page"

If that is not an option then you will need to go with the original answer, Let me know and i will post the best way to do this.


Ideally you would want to pass around unique ID numbers for each row rather than the serial number its self (or customers name if thats what your doing)

But as I said, if you could tell me your database structure. If this is sensitive information, feel free to send me an email (which is in my profile)