request.querystring("something")(item)

[magix8]

Hi,

I have form GET method, example:

index.asp?Type=1&Type=3&Type=4&....


So,
I have something like this at the receiver side to retrieve multiple
Type value and insert into tables.

Set QINSERT = Server.CreateObject("ADODB.Recordset")
For Each item In Request.QueryString("Type")
SQL= " INSERT INTO tblType (TypeID, UserID) VALUES ('" &
Request.QueryString("Type")(item) & Session("ID") & "')"
Set QINSERT = conn.execute(SQL)
Next


But within the FOR statement, it ended up Internet 500 Error. What
did I do wrong ? Is Request.QueryString("Type")(item) correct ?

Session("ID") is OK. TypeID, UserID are correct too.

Please help to tell me what is wrong.

Regards,
magix

 

[magix8]

Hi,

I have form GET method, example:

index.asp?Type=1&Type=3&Type=4&....

So,
I have something like this at the receiver side to retrieve multiple
Type value and insert into tables.

   Set  QINSERT  = Server.CreateObject("ADODB.Recordset")
   For Each item In Request.QueryString("Type")
                                                        SQL= " INSERT INTO tblType (TypeID, UserID) VALUES ('" &
Request.QueryString("Type")(item) & Session("ID") & "')"
        Set QINSERT = conn.execute(SQL)
   Next

   But within the FOR statement, it ended up Internet 500 Error. What
did I do wrong ? Is Request.QueryString("Type")(item) correct ?

Session("ID") is OK. TypeID, UserID are correct too.

Please help to tell me what is wrong.

Regards,
magix

Issue resolved and closed.

 

[Evertjan.]

(e-mail address removed) wrote on 26 dec 2007 in

(e-mail address removed) wrote on 26 dec 2007 in

Issue resolved and closed.

1 Since you are not the owner of usenet,
you cannot close an issue,
even if you opened it.

2 If you resolved your programming mistake,
it would be considerate to tell others,
that have already spent time thinking about it,
how and what.

====

Doing what you did with Request.QueryString,
if done on the open web,
is very dangerous for SQL injection.

Always validate all incoming data first,
or ask Bob for that other way,
which name always escapes me,
as I never use it.

 

[Mike Brind]

(e-mail address removed) wrote on 26 dec 2007 in

1 Since you are not the owner of usenet,
you cannot close an issue,
even if you opened it.

2 If you resolved your programming mistake,
it would be considerate to tell others,
that have already spent time thinking about it,
how and what.

====

Doing what you did with Request.QueryString,
if done on the open web,
is very dangerous for SQL injection.

Always validate all incoming data first,
or ask Bob for that other way,
which name always escapes me,
as I never use it.

It's called parameters. And it isn't an alternative. It's as well as.
It's useful for preventing other potential problems - not just Sql
Injection.

 

[Evertjan.]

Mike Brind wrote on 29 dec 2007 in
microsoft.public.inetserver.asp.general:

It's called parameters.

Ah yes, I was thinking about parainches or orthoyards,
but I am glad it turns out to be metric after all.

And it isn't an alternative. It's as well as.

That is what alternative means, though I did not use that word.

It's useful for preventing other potential problems - not just Sql
Injection.

Please elaborate for us.

 

[Mike Brind]

Mike Brind wrote on 29 dec 2007 in
microsoft.public.inetserver.asp.general:


Ah yes, I was thinking about parainches or orthoyards,
but I am glad it turns out to be metric after all.


That is what alternative means, though I did not use that word.


Please elaborate for us.

The main additional benefit is that you don't need to delimit values in
concatenated SQL strings, which removes the source of a number of errors
posted here, such as datatype mismatches and syntax errors. With
parameters, you would still perform server-side validation of values (for
range, datatype etc), but you are right - you don't need to specifically
validate against Sql injection attempts.