Need Help with Form Data to SQL Injection

See more:

ASP.NET

SQL

Hello

I have never done any code like this before (I am a web designer).

We have a 'dealer request' form on out website, where 'dealers' can put in there Name, Contact Info, Dealer Account #, etc.

Currently - when this form is filled out and submitted, all that happens is that I get an email with that information, and then I manually input it into the SQL database.

I followed a tutorial online, but each time I hit the 'submit', I just get a 500 Internal Server error. Here is the current form_ac.asp (I removed the login credentials obviously):

<%
' Declaring variables
Dim first, last, account, email, state, comments, data_source, con, sql_insert

' A Function to check if some field entered by user is empty
Function ChkString(string)
	ChkString = Replace( Trim(string) , "'", "''")
End Function

' Receiving values from Form
first = ChkString(Request.Form("first"))
last = ChkString(Request.Form("last"))
dealer = ChkString(Request.Form("dealer"))
account = ChkString(Request.Form("account"))
email = ChkString(Request.Form("email"))
state = ChkString(Request.Form("state"))
phone_area = ChkString(Request.Form("phone_area"))
data_source = Server=SERVERNAME; Database=DB NAME;User Id=USERID;Password=PASSWORD; 
sql_insert = "insert into users (first, last, dealer, account, email, state, phone_area) values ('" & _
                first & "','" last & "','" & dealer & "', '" & account & "', '" & email & "', '" & state & "', '" & phone_area & "')"


' Creating Connection Object and opening the database
Set con = Server.CreateObject("ADODB.Connection")
con.Open data_source
con.Execute sql_insert

' Done. Close the connection
con.Close
Set con = Nothing
%>

Any advice, suggestions or guidance would be greatly appreciated.