Showing posts with label sqli. Show all posts
Showing posts with label sqli. Show all posts

Sunday, February 19, 2012

ASP2.0 INSERT into SQL2000 problems

First thanks for any help anyone can give me. Here is the environment: SQL2000 server, 2003 Web server, ASP2.0, SQL

I've banged my head around trying to get this code to insert some data into a table cell on a db table, and it simply is not working, through trial and error i've figured that I simply have wrote crappy sql code so if anyone can give it a look over and see if they notice what the devil I missed, it would be much appreciated, if you need to see more of the code give me a shout.

If (Page.IsValid = True)

' MailClient.Send(MailFrom, MailTo, MailSubject, MailBody)'

Dim SQLConn As SqlConnection = New SqlConnection()
SQLConn.ConnectionString = ConfigurationSettings.AppSettings("ConnectionString")
SQLConn.Open()
Dim strSQL As String = "INSERT INTO kittens (email) VALUES (frogger);"
SQLConn.Close()

End If
End Sub

Remove the semi-colin from ther end of the query, also 'frogger' should be encapsulated in single quotes. All text, ntext, varchar, nvarchar, etc.. need to have their values in quotes unless passed through a variable.

INSERT INTO kittens (email) VALUES ('frogger')

|||

bluemistonline:

Remove the semi-colin from ther end of the query, also 'frogger' should be encapsulated in single quotes. All text, ntext, varchar, nvarchar, etc.. need to have their values in quotes unless passed through a variable.

INSERT INTO kittens (email) VALUES ('frogger')

Did you also mean for me to take the "" from the statements as well? With those taken out I get a (BC30205: End of statement expected) error.

I guess I will post the whole code (the nonhtml stuff anyway) and see if anyone notices anything. I'm beginning to wonder if I have the sql table itself not set up right somehow. As is obvious I am very new to ASP.net and SQL as in I new nothing about how to code either until I started on this recent project so I am learning by doing :b

login.aspx code

<%@. Page Explicit="true" debug="true" language="vb" %>
<%@. Import Namespace="System.Data" %>
<%@. Import Namespace="System.Data.SqlClient" %>
<%@. Import Namespace="System.Data.Mail" %>
<%@. Import Namespace="System.Net.Mail" %>

<script runat="server">
Sub submitClick(Source as Object, E as EventArgs)

Dim eMsg as String

eMsg +="Customer Information" & vbcrlf
eMsg +="Email: " & txtEmail.Text & vbcrlf
eMsg +="Company: " & txtCompany.Text & vbcrlf
eMsg +="Last Name: " & txtLastName.Text & vbcrlf
eMsg +="First Name: " & txtFirstName.Text & vbcrlf
eMsg +="Phone Number: " & txtPhoneNumber.Text & vbcrlf

Dim MailClient = New SmtpClient("xxx.xxxx.xxx.xxxxx")
Dim MailFrom As String = "mittens@.mittens.com"
Dim MailTo As String = "scarf@.scarf.com"
Dim MailSubject As String = "New Customer Information"
Dim MailBody As String = eMsg

If (Page.IsValid = True)

' MailClient.Send(MailFrom, MailTo, MailSubject, MailBody)'

Dim SQLConn As SqlConnection = New SqlConnection()
SQLConn.ConnectionString = ConfigurationSettings.AppSettings("ConnectionString")
SQLConn.Open()
Dim strSQL As String = INSERT INTO cuinfo ('email') VALUES ('frogger')
SQLConn.Close()

End If
End Sub

</script>

And this is the web.config

<configuration>
<appSettings>
<add key="ConnectionString" value="DataSource=mittens@.mittens.com;UID=mittens;pwd=itsasecret" />
<add key="ConnectionString" value="Server=xxx.xxxx.xxx.xxxxx;database=kittens;UID=mew;pwd=mewmew;Trusted_Connection=True" />
</appSettings>
<system.web>
<sessionState cookieless="false" timeout="20" />
<customErrors mode="Off"/>
</system.web>
</configuration>

For the SQL table itself, the UID "mew" doesn't have to be owner of the table correct, the only they need is the write access. Currently what happens is the submit button on login.aspx is clicked and the screen refreshes without any errors, and the email with the data is sent (or would be if I didn't have it commented out right now), but nothing appears in the database table. I manually go to the table and right-click tell it to show all rows and it shows an empty table. The email column is empty and in this case frogger does not show up in it.

Thx for any help.

|||

No put the double quotes back. Basic .NET systax requires you to encapsulate all string values in double quotes!!!

Maybe your should brush up on .NET systax before posting absurd questions.

Here is a good link:http://authors.aspalliance.com/aspxtreme/aspnet/syntax/aspnetsyntax.aspx

|||

Change:

SQLConn.Open()
Dim strSQL As String = INSERT INTO cuinfo ('email') VALUES ('frogger')
SQLConn.Close()

to:

SQLConn.Open()

Dim cmd as new SqlCommand("INSERT INTO cuinfo(email) VALUES (@.email)",SQLConn)

cmd.Parameters.Add("@.email",sqldbtype.Varchar).Value=txtEmail.Text

cmd.ExecuteNonQuery

SQLConn.Close

|||

Thx Motley, that seemed to fix that problem, a new one cropped up, but I'm going to try and work it, before deciding whether to post for help.

Thx again for the help Motley.

Sunday, February 12, 2012

ASP.Net and MS SQL

Dreamweaver MX and ASP.Net and MS SQL

I am displaying a page of lists of addresses based on state.

.../results.aspx?state=id

I want to add a little "re-sort" links. For example: sort by | name | city | style

.../results.aspx?state=id&sort=city
(if sort is missing default to "sort=name")

But I a having a problems... here is part of my code, following dreamwevers standards for ASP.Net -

CommandText='<%# "SELECT * FROM tblRestaurants WHERE ""State"" = @.State ORDER BY @.Sort ASC" %>'

<parameters>
<parameter name="@.State" value='<%# IIf((Request.QueryString("state") <> Nothing), Request.QueryString("state"), "") %>' type="VarChar" />
<parameter name="@.Sort" value='<%# IIf((Request.QueryString("sort") <> Nothing), Request.QueryString("sort"), "name") %>' type="VarChar" />
</parameters
But "@.Sort" is causing errors, I think @. is a reserved keyword in MS SQL (?),
here is the error message -

System.Data.SqlClient.SqlException: The SELECT item identified by the ORDER BY number 1 contains a variable as part of the expression identifying a column position. Variables are only allowed when ordering by an expression referencing a column name.

I have tried to change @.Sort about a dozen different names "MMSort", "urlSort" etc.
here is the error message -

System.Data.SqlClient.SqlException: Line 1: Incorrect syntax near 'urlSort'.

One side note, I displaying the results in a repeating datalist, a datagrid is out.
A rough draft version without working sort is at
http://www.jbmcgregor.com/cira/results.aspx?state=id

Any suggestion, ideas or help would be extremely appreciated. Thanks.

DanielIt would help if you provide the actual sql query that gets executed. Use Try...Catch to catch the exception and use response.write to figure out exactly what was the sql command that gets executed. Probably it is a systax error.