How do I fix my report.asp error?

Question

1.00/5 (2 votes)

See more:

Hello, in a business we use notepad++ to read report.asp. Which when a student clicks a button it brings them to a page where they can print their certificate. When they try to get the certificate it will not work. This is the error i get:

]You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ’
/courses/0000992_PL/report.asp, line 46.

This is the report.asp (line 19):

align=“center”><form method=“post”>
<input type = “submit” name=“mybutton3” value = “Print or Save your Home Inspector Certificate and Exit”/>

What I have tried:

I tried retyping other that i'm unsure why it wont.

Posted 25-Jun-18 4:40am

CRogers25

Updated 25-Jun-18 5:30am

Add a Solution

Comments

Dave Kreskowiak 25-Jun-18 10:42am

This error has nothing to do with the HTML. It's talking about a MySQL query statement and you didn't post that here.

It even told you which line to look at in the report.asp code, and you went to a completely different line! WHY?!

CRogers25 25-Jun-18 10:45am

MY apologies, i meant to post:

(46)Set rs_courses = oConn.Execute(strSQL)
strSQL2="UPDATE enrollments SET Score=100 WHERE CourseID="&CourseID&" AND UserName='"&i_name&"' AND UserPass='"&i_pass&"'"
Set rs_courses2 = oConn.Execute(strSQL2)
Set objRS = oConn.Execute(uRID)

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

OriginalGriff · Answer 1 · 2018-06-25T05:31:00

strSQL2="UPDATE enrollments SET Score=100 WHERE CourseID="&CourseID&" AND UserName='"&i_name&"' AND UserPass='"&i_pass&"'"

Start by not doing that. Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'

The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'

Which SQL sees as three separate commands:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'x';

A perfectly valid SELECT

SQL

DROP TABLE MyTable;

A perfectly valid "delete the table" command

SQL

--'

And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?
Get rid of the concatenation, and the chances are that your SQL error will go at teh same time.