asp problem

[^MisterJingo^]

Hi all,
I've been asked to take a look at some asp code and am having trouble
finding where the problem lies.
The asp app itself contains a link to a second page, passing some
parameters on the query string. These parameters are used to stream a
file for downloading. This all works fine.
Just before stream occurs, I need to log the passed parameters into a
database. THis is done by calling the following function:

sub saveClipInfo(category,no,clipMode)
dateNow = year(now)&"-"&month(now)&"-"&day(now)& " "&time()
sql = "INSERT INTO tbl_podcasts
(category,clipNo,userID,forename,surname,studentYear,clipMode,dateNow)
VALUES ('"&category&"',"&no&", '"&session("userID")&"',
'"&session("forename")&"', '"&session("surname")&"',
"&right(trim(session("sYear")),1)&", '"&clipMode&"', '"&dateNow&"')"
conn.execute(sql)
end sub

Even though the paramters are being passed correctly, nothing is added
to the database. To make the problem more confusing, this function is
used elsewhere and works correctly. So it seems to be a problem with
the stream page?

Any help would be appreciated.

 

[Bob Barrows [MVP]]

Hi all,
I've been asked to take a look at some asp code and am having trouble
finding where the problem lies.
The asp app itself contains a link to a second page, passing some
parameters on the query string. These parameters are used to stream a
file for downloading. This all works fine.
Just before stream occurs, I need to log the passed parameters into a
database.

What database? Type and version please. This information is alomostalways
relevant when asking a database-related question, and is definitely relevant
in this case.

THis is done by calling the following function:

sub saveClipInfo(category,no,clipMode)
dateNow = year(now)&"-"&month(now)&"-"&day(now)& " "&time()
sql = "INSERT INTO tbl_podcasts
(category,clipNo,userID,forename,surname,studentYear,clipMode,dateNow)
VALUES ('"&category&"',"&no&", '"&session("userID")&"',
'"&session("forename")&"', '"&session("surname")&"',
"&right(trim(session("sYear")),1)&", '"&clipMode&"', '"&dateNow&"')"

For debugging purposes, put these statements here:

Response.Write sql
Response.End

Run the page and make sure the sql statement is what you intend it to be.

conn.execute(sql)

Is "conn" defined somewhere? Do you have "On Error Resume Next" somewhere
masking errors?

Further points to consider:
Your use of dynamic sql is leaving you vulnerable to hackers using sql
injection:
http://mvp.unixwiz.net/techtips/sql-injection.html
http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23

See here for a better, more secure way to execute your queries by using
parameter markers:
http://groups-beta.google.com/group/microsoft.public.inetserver.asp.db/msg/72e36562fee7804e