Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

BoardsMember · 12-09-2014 1:58pm

Beano wrote: »

In fairness if you are concerned with sql injection (and you should be) then stored procs is the way to go. this whole idea of building up queries in code went out with the indians.

100% agree, but based on posts to date, I think we have to deal with what we're dealing with.

Beano · 12-09-2014 1:59pm

BoardsMember wrote: »

100% agree, but based on posts to date, I think we have to deal with what we're dealing with.

good point.

MikeFantana · 12-09-2014 3:11pm

Graham wrote: »
To follow on from Berserkers suggestion, if in doubt, response.write it out.

So after
countyID = Request.QueryString("CountyID")
do a
response.write countyID

Ok so i have added the dims

dim countyID
dim ConTypeID
dim ConBusName
countyID = Request.QueryString("CountyID")
response.write countyID
ConTypeID = Request.QueryString("ConTypeID")
response.write ConTypeID       
ConBusname = Request.QueryString("ConBusName")
response.write ConBusName

and it writes back the corerct parameters to screen,

I tried to add the Response.Querysting to my conditions but alas no luck, making a right mess of it.

sSQL = "SELECT * FROM dbo.qrySearchResults "

            conditions = ""

           

            If Param1 <> "" Then           

                conditions = "CountyID=" Request.QueryString ('& MMColParam1&')

            End If

Beano · 12-09-2014 3:18pm

once you have taken the values from the querystring into the variables then there is no need to used the querystring after that. you then use the variables are you were using them before.

can i ask what this is for? It seems a very trivial example so is this a college project or something?

Graham · 12-09-2014 3:31pm

I strongly suspect you're trying to edit dreamweavers autowaffle ASP code here OP.

If that's the case, I'd recommend you stop, start again with a nice clean hand-coded example, there's millions of good ones still floating about on the net. Do a search for "Classic ASP Query SLQ Database" or something along those lines, add a -.net if required.

BoardsMember · 12-09-2014 3:33pm

There is no Param1...Parameters are for SPs and the like, you are trying to write inline query

dim countyID
dim ConTypeID
dim ConBusName

countyID = Request.QueryString("CountyID")
ConTypeID = Request.QueryString("ConTypeID")
ConBusname = Request.QueryString("ConBusName")

sSQL = "SELECT * FROM dbo.qrySearchResults "
if countyID <> "" then sSQL = sSQL & " WHERE CountyId =" & countyID
if ConTypeID <> "" then sSQL = sSQL & " AND ConTypeID=" & ConTypeID

etc...

Obviously you must have one "WHERE" and the rest "AND"s. And you need to sanitise the querystring values, as already posted.

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

Comments