why doesn't it insert in database?

Discussion in 'Databases' started by gilgalbiblewheel, Jun 15, 2006.

  1. #1
    <html>
    
    <body>
    
    <form action="feedbacksent.asp" method="get" enctype="text/plain">
    
    <h3>Your feedback is important.</h3> 
    <h5>To send your comments put your:</h5><br>
    Name:<br>
    <input type="text" name="[B][COLOR=Red]name[/COLOR][/B]" size="18" value="Put your name" class="form-input" onBlur="if(this.value==''){this.value='Put your name';}" onFocus="if(this.value=='Put your name'){this.value='';}">
    
    <br>
    Email:<br>
    <input type="text" name="[B][COLOR=Blue]email[/COLOR][/B]" size="22" value="Put your email address" class="form-input" onBlur="if(this.value==''){this.value='Put your email address';}" onFocus="if(this.value=='Put your email address'){this.value='';}">
    
    <br>
    Subject:<br>
    <input type="text" name="[B][COLOR=DarkOrange]subject[/COLOR][/B]" size="40" value="Put your subject" class="form-input" onBlur="if(this.value==''){this.value='Put your subject';}" onFocus="if(this.value=='Put your subject'){this.value='';}">
    
    <br>
    <textarea rows="10" name="[B][COLOR=Green]comment[/COLOR][/B]" cols="60" value="Put your comments" class="form-input" onBlur="if(this.value==''){this.value='Put your comments';}" onFocus="if(this.value=='Put your comments'){this.value='';}"></textarea>
    <br><br>
    <input type="submit" value="Send">
    <input type="reset" value="Reset">
    
    </form>
    </body>
    </html>
    
    Code (markup):
    <html>
    <body>
    
    <%
    'Dim connStr
    'connStr = "Provider=Microsoft.Jet.OLEDB.4.0; Data Source=" & Server.MapPath("Kjv.mdb")
    set conn=Server.CreateObject("ADODB.Connection")
    conn.Provider="Microsoft.Jet.OLEDB.4.0"
    conn.Open "kjv.mdb"
    
    sql="INSERT INTO feedback (ID,name,"
    sql=sql & "subject,email,comment)"
    sql=sql & " VALUES "
    sql=sql & "('" & Request.Form("ID") & "',"
    sql=sql & "'" & Request.Form("[B][COLOR=Red]name[/COLOR][/B]") & "',"
    sql=sql & "'" & Request.Form("[B][COLOR=Blue]email[/COLOR][/B]") & "',"
    sql=sql & "'" & Request.Form("[B][COLOR=DarkOrange]subject[/COLOR][/B]") & "',"
    sql=sql & "'" & Request.Form("[B][COLOR=Green]comment[/COLOR][/B]") & "')"
    
    on error resume next
    conn.Execute sql,recaffected
    if err<>0 then
      Response.Write("No update permissions!")
    else 
      Response.Write("<h3>" & recaffected & " record added</h3>")
    end if
    conn.close
    %>
    
    </body>
    </html>
    Code (markup):

     
    gilgalbiblewheel, Jun 15, 2006 IP
  2. DanInManchester

    DanInManchester Active Member

    Messages:
    116
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    53
    #2
    Do you get an error message? the code looks like it should work.
    Try removing on error resume next and seeing if you get a full error message.

    On an aside to you problem .....

    One thing to note is that your coding technique could be improved.
    By useing dynamic SQL like that you are leaving your self open to SQL injjection attack and application errors espcially as you are not validating user input either.

    My advice would be to stick to parameterised SQL where ever possbile.

    Also your database is stored within the root of the site making it insecure.
     
    DanInManchester, Jun 16, 2006 IP
  3. vectorgraphx

    vectorgraphx Guest

    Messages:
    545
    Likes Received:
    16
    Best Answers:
    0
    Trophy Points:
    0
    #3
    where are you getting "Request.Form("ID")" from? i dont see it in your form. is this your autonumber primary field? if so - you can't designate what to write to it. take it out of your sql and you should be ok.

    VG
     
    vectorgraphx, Jun 16, 2006 IP