Click here to Skip to main content
15,177,490 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
I’m trying to insert data (which has been entered by the user through a form) into an access database. I am not getting any errors, however it is not entering the data. Any thought?Please help me

<pre><%
  
   dim risposta1
   dim risposta2
   dim risposta3
   dim risposta4
   dim risposta5
   dim risposta6
   dim conn
   dim rs
   dim strsql
risposta1=request.form("risp1")
risposta2=request.form("risp2")
risposta3=request.form("risp3")
risposta4=request.form("risp4")
risposta5=request.form("risp5")
risposta6=request.form("risp6")
set conn=server.createobject("adodb.connection")
conn.open "driver={Microsoft Access Driver (*.mdb)};dbq=" & server.mappath("database.mdb")
strsql= "insert into t_risposte(risposta1,risposta2,risposta3,risposta4,risposta5,risposta6) values('" & risp1 & "','" & risp2 &"','" & risp3 & "','" & risp4 & "','" & risp5 & "','" & risp6 & "');" 
set rs=server.createobject("adodb.recordset")
rs.open strsql,conn
 response.write  ("<p style='color:white;font-size:20px;text-align:center';>Le tue risposte al questionario sono state registrate</p>")
set rs=nothing
conn.close
set conn=nothing
%> 


What I have tried:

I tried to find a solution but i can't understand what's wrong...
Posted
Updated 20-Jun-21 4:52am

Don't do it like that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SQL
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
SQL
DROP TABLE MyTable;
A perfectly valid "delete the table" command
SQL
--'
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

And for a login screen? All that means is I can also bypass your login and log in as any user I want without knowing the password ...

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

Then there is the actual INSERT - which appears to be trying to insert the column names into empty variables ...
The syntax of an INSERT is simple:
SQL
INSERT INTO <TableName> (<List of column names in the DB>) VALUES (<list of values or parameters to insert>)

Yours looks to be completely the wrong way round ...
   
Comments
Member 15254297 20-Jun-21 9:18am
   
Ok I appreciate your help but...I still can't understand how to fix my problem. The concatenating thing still doesn't resolve it :/ I am sorry to bother you but I am still learning about this stuff
VB
strsql= "insert into t_risposte(risposta1,risposta2,risposta3,risposta4,risposta5,risposta6) values('" & risp1 & "','" & risp2 &"','" & risp3 & "','" & risp4 & "','" & risp5 & "','" & risp6 & "');" 

Not necessary a solution to your question, but another problem you have.
Never build an SQL query by concatenating strings. Sooner or later, you will do it with user inputs, and this opens door to a vulnerability named "SQL injection", it is dangerous for your database and error prone.
A single quote in a name and your program crash. If a user input a name like "Brian O'Conner" can crash your app, it is an SQL injection vulnerability, and the crash is the least of the problems, a malicious user input and it is promoted to SQL commands with all credentials.
SQL injection - Wikipedia[^]
SQL Injection[^]
SQL Injection Attacks by Example[^]
PHP: SQL Injection - Manual[^]
How can I explain SQL injection without technical jargon? - Information Security Stack Exchange[^]
   
Comments
Member 15254297 20-Jun-21 9:18am
   
Ok I appreciate your help but...I still can't understand how to fix my problem. The concatenating thing still doesn't resolve it :/ I am sorry to bother you but I am still learning about this stuff
Quote:
It is not a good idea to use the Source argument of the Open method to perform an action query that does not return records because there is no easy way to determine whether the call succeeded. The Recordset returned by such a query will be closed. To perform a query that does not return records, such as a SQL INSERT statement, call the Execute method of a Command object or the Execute method of a Connection object instead.


From: Open Method (ADO Recordset) - ActiveX Data Objects (ADO) | Microsoft Docs[^].
   
Comments
Member 15254297 20-Jun-21 10:13am
   
thanks for your help but is it possible to know how the code would look like with these changes you listed? Sorry but I am still learning...
Richard MacCutchan 20-Jun-21 11:05am
   
If you are still learning then make use of the documentation and tutorials that are available. If you go to the link I gave you you can follow through to the page that explains the Execute method.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)




CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900