Web Wiz - Green Windows Web Hosting
Web Wiz Homepage Search Web Wiz

  New Posts New Posts RSS Feed - inserting data through ASP Page
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

inserting data through ASP Page
 Post Reply Post Reply
Author
  Topic Search Topic Search  Topic Options Topic Options
gupta_ji View Drop Down
Groupie
Groupie
Avatar

Joined: 29 October 2003
Location: India
Status: Offline
Points: 70 		Post Options Post Options   Thanks (0) Thanks(0)   Quote gupta_ji Quote  Post ReplyReply Direct Link To This Post Topic: inserting data through ASP Page
    Posted: 20 September 2004 at 3:46pm

I am trying to insert the data through SQL Query (more than 255 Characters) in a MEMO field of an MS Access Database. But I am getting following error

Microsoft JET Database Engine error '80040e14'

Syntax error (missing operator) in query expression ''I

If I reduce the data below 255 Characters the query works perfectly.

Can anybody help me on this.
chartered accountants India, accounting Outsourcing ISO Certification
Back to Top
michael View Drop Down
Senior Member
Senior Member
Avatar

Joined: 08 April 2002
Location: United States
Status: Offline
Points: 4670 		Post Options Post Options   Thanks (0) Thanks(0)   Quote michael Quote  Post ReplyReply Direct Link To This Post Posted: 20 September 2004 at 4:18pm
That usually happens if you do not cancel out your quotes. If you parse the sql insert as text, and it contains a ' or a " then the sql will think there is a end of char and expects some operateor next. Make sure to read up on SQL Injection prevention to get around that, could give you a simpler answer but it would leave your site VERY vounerable.
Blog | MPG Tracker
Back to Top
gupta_ji View Drop Down
Groupie
Groupie
Avatar

Joined: 29 October 2003
Location: India
Status: Offline
Points: 70 		Post Options Post Options   Thanks (0) Thanks(0)   Quote gupta_ji Quote  Post ReplyReply Direct Link To This Post Posted: 20 September 2004 at 4:25pm

Thanks for your reply.

But I donot know how to cancel the quotes. Can you tell me. I am mention below my update query.

description=Request.Form("description")

strsql = "insert into query(cid, description, company, name, email, phone, address, turnover, employees, sites, products, tdate, country)" & _ "values('" & cid & "','" & description & "','" & company & "','" & name & "','" & email & "','" & phone & "','" & address & "','" & turnover & "','" & employees & "','" & sites & "','" & products & "','" & tdate & "','" & country & "')"

I am getting error on "description" Field.

 
chartered accountants India, accounting Outsourcing ISO Certification
Back to Top
Mart View Drop Down
Senior Member
Senior Member
Avatar

Joined: 30 November 2002
Status: Offline
Points: 2304 		Post Options Post Options   Thanks (0) Thanks(0)   Quote Mart Quote  Post ReplyReply Direct Link To This Post Posted: 20 September 2004 at 4:27pm
You could do it with a replace, but as Michael says that will leave you open to SQL injection attacks.

Check out google http://www.google.com/search?hl=en&lr=&ie=UT F-8&client=firefox-a&q=prevent+sql+injection+asp& ;btnG=Search

Or A9 http://a9.com/prevent%20sql%20injection%20asp
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.

Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.