Updating a database 1

Bodhi147 · Jan 24, 2003

Intern who needs a little help,

All I want to do is have the user enter their name then click on the submit button and it will update a database. I am stuck.

Help would be greatly appreciated
Thanks

<html>

<head>
<title>New Page 1</title>
</head>

<body>
<%
Dim Name, data_source, con, sql_insert, database_type
Name=Request.Form("Name&quot

data_source = "Provider=Microsoft.Jet.OLEDB.4.0;" & _
"Data Source=a:Completed.mdb;" & _
"Persist Security Info=False"
sql_insert = "insert into Users (Name)"

Set con = Server.CreateObject("ADODB.Connection&quot

con.Open data_source
con.Execute sql_insert

con.Close
set con = Nothing

Response.Write "You entered: " & Name
%>
</body>
</html>

onpnt · Jan 24, 2003

try
sql_insert = "insert into Users VALUES(Name)"

also a bit of advice. never name a field Name or a variable. this is a very widly used built in method to extract data from objects, making it a possible restrcted word for use in such naming practices.
_______________________________________________
_{{ str = "sleep is good for you. sleep gives you the energy you need to function";

ptr = /sleep/gi;Nstr = str.replace(ptr,"coffee"alert(Nstr); }}
_______________________________________________
for the best results to your questions: FAQ333-2924
has you're questio

Tarwn · Jan 24, 2003

Two additonal corrections, unless Name is the only field in your table you will need to specify it after your table name like so:
"INSERT INTO Users(Name) Values..."

Which brings me to the second correction, the Values portion should have the actual variable with the name in it concatenated in, like so:
"INSERT INTO Users(Name) VALUES('" & Name & "')"

The single quotes around the value we are inserting tells the database that this is a string.

One more addition, if you have someone with the name O'Brian than your going to receive an error because the db will see the single quote and think you are done with the string. Then it will see the rest of the string and give you a syntax error. The other problem is that not replacing single quotes can leave you vulnerable for a SQL injection attack, so it would be best if you were to replace the single quotes with the escape character for single quotes (which happnes to be two single quotes in a row.):
"INSERT INTO Users(Name) VALUES('" & Replace(Name,"'","''" & "')"

Hope that helps,
-Tarwn ________________________________________________________________________________
Want to get great answers to your Tek-Tips questions? Have a look at faq333-2924

Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Updating a database 1

Bodhi147

MIS

onpnt

Programmer

Tarwn

Programmer

Similar threads

Part and Inventory Search

Sponsor