Database lookup problem

[gfender]

Hi everyone,
I'm implementing a computer inventory system using ADO and python with SQL Server 2K. My problem is with the following code:

def lookupHdw( barcode ):
(hdwLook, success) = conn.Execute("SELECT emp FROM table1 WHERE CPU = " + barcode )
Response.Write( hdwLook.Fields("emp&quot.Value )

lookupHdw( "HTS00002560" )

I'm using python with asp so i get the following error at runtime: "Invalid column name 'HTS00002560'". I've run this statement using SQL query analyzer and it worked fine.
I believe it's an issue with strings because i did a function identical to this one except with numeric values and not varchar's and it worked great. Also, the data type of CPU in the table is nvarchar.
Please help, this is a pivotal point in my project and is driving my against the wall.
THANK YOU!!!

-Gabe

 

[gfender]

Nevermind, I figured it out. Thanks anyways.

 

[Tarwn]

Post the answer, I was waiting to see it, I'm all curious now

_{01010100 01101001 01100101 01110010 01101110 01101111 01101011 00101110 01100011 01101111 01101101}
^{29 3K 10 3D 3L 3J 3K 10 32 35 10 3E 39 33 35 10 3K 3F 10 38 31 3M 35 10 36 3I 35 35 10 3K 39 3D 35 10 1Q 19}
Do you know how hot your computer is running at home? I do

http://www.tiernok.com/hscripts/systemp.asp

 

[sebsauvage]

He didn't quote the value.
This should be:

[tt]def lookupHdw( barcode ):
(hdwLook, success) = conn.Execute("SELECT emp FROM table1 WHERE CPU = '" + barcode+ "'")
Response.Write( hdwLook.Fields("emp&quot.Value )[/tt]

And for security reason, he'd better protect his application from the SQL-Injection attack with:

[tt]def lookupHdw( barcode ):
(hdwLook, success) = conn.Execute("SELECT emp FROM table1 WHERE CPU = '" + barcode.replace("'","''&quot + "'&quot
Response.Write( hdwLook.Fields("emp&quot.Value )[/tt]

 

[Tarwn]

Heh, sorry, just started with Python recently, should have noticed that error, it's pretty common across all languages...

_{01010100 01101001 01100101 01110010 01101110 01101111 01101011 00101110 01100011 01101111 01101101}
^{29 3K 10 3D 3L 3J 3K 10 32 35 10 3E 39 33 35 10 3K 3F 10 38 31 3M 35 10 36 3I 35 35 10 3K 39 3D 35 10 1Q 19}
Do you know how hot your computer is running at home? I do

http://www.tiernok.com/hscripts/systemp.asp

 

[gfender]

Thanks, I didn't realize the vulernability until just now. I appreciate it.