ASP - request.querystring("something")(item)

Author

request.querystring("something")(item)

magix8@gmail.com

2007-12-26, 3:56 am

Hi,

I have form GET method, example:

index.asp?Type=1&Type=3&Type=4&....

So,
I have something like this at the receiver side to retrieve multiple
Type value and insert into tables.

Set QINSERT = Server.CreateObject("ADODB.Recordset")
For Each item In Request.QueryString("Type")
SQL= " INSERT INTO tblType (TypeID, UserID) VALUES ('" &
Request.QueryString("Type")(item) & Session("ID") & "')"
Set QINSERT = conn.execute(SQL)
Next

But within the FOR statement, it ended up Internet 500 Error. What
did I do wrong ? Is Request.QueryString("Type")(item) correct ?

Session("ID") is OK. TypeID, UserID are correct too.

Please help to tell me what is wrong.

Regards,
magix

magix8@gmail.com

2007-12-26, 3:56 am

On Dec 26, 11:04=A0am, "mag...@gmail.com" <mag...@gmail.com> wrote:
> Hi,
>
> I have form GET method, example:
>
> index.asp?Type=3D1&Type=3D3&Type=3D4&....
>
> So,
> I have something like this at the receiver side to retrieve multiple
> Type value and insert into tables.
>
> =A0 =A0Set =A0QINSERT =A0=3D Server.CreateObject("ADODB.Recordset")
> =A0 =A0For Each item In Request.QueryString("Type")
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 SQL=3D " INSERT INTO tblType (TypeID=
, UserID) VALUES ('" &
> Request.QueryString("Type")(item) & Session("ID") & "')"
> =A0 =A0 =A0 =A0 Set QINSERT =3D conn.execute(SQL)
> =A0 =A0Next
>
> =A0 =A0But within the FOR statement, it ended up Internet 500 Error. What
> did I do wrong ? Is Request.QueryString("Type")(item) correct ?
>
> Session("ID") is OK. TypeID, UserID are correct too.
>
> Please help to tell me what is wrong.
>
> Regards,
> magix

Issue resolved and closed.

Evertjan.

2007-12-26, 7:56 am

magix8@gmail.com wrote on 26 dec 2007 in
> magix8@gmail.com wrote on 26 dec 2007 in
>
> Issue resolved and closed.

1 Since you are not the owner of usenet,
you cannot close an issue,
even if you opened it.

2 If you resolved your programming mistake,
it would be considerate to tell others,
that have already spent time thinking about it,
how and what.

====

Doing what you did with Request.QueryString,
if done on the open web,
is very dangerous for SQL injection.

Always validate all incoming data first,
or ask Bob for that other way,
which name always escapes me,
as I never use it.

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

Mike Brind

2007-12-29, 7:56 am

"Evertjan." <exjxw.hannivoort@interxnl.net> wrote in message
news:Xns9A126B9F17C4Ceejj99@194.109.133.242...
> magix8@gmail.com wrote on 26 dec 2007 in
>
> 1 Since you are not the owner of usenet,
> you cannot close an issue,
> even if you opened it.
>
> 2 If you resolved your programming mistake,
> it would be considerate to tell others,
> that have already spent time thinking about it,
> how and what.
>
> ====
>
> Doing what you did with Request.QueryString,
> if done on the open web,
> is very dangerous for SQL injection.
>
> Always validate all incoming data first,
> or ask Bob for that other way,
> which name always escapes me,
> as I never use it.
>

It's called parameters. And it isn't an alternative. It's as well as.
It's useful for preventing other potential problems - not just Sql
Injection.

--
Mike Brind

Evertjan.

2007-12-29, 7:56 am

Mike Brind wrote on 29 dec 2007 in
microsoft.public.inetserver.asp.general:

>
> "Evertjan." <exjxw.hannivoort@interxnl.net> wrote in message
> news:Xns9A126B9F17C4Ceejj99@194.109.133.242...
>
> It's called parameters.

Ah yes, I was thinking about parainches or orthoyards,
but I am glad it turns out to be metric after all.

> And it isn't an alternative. It's as well as.

That is what alternative means, though I did not use that word.

> It's useful for preventing other potential problems - not just Sql
> Injection.

Please elaborate for us.

--
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

Mike Brind

2007-12-31, 3:56 am

"Evertjan." <exjxw.hannivoort@interxnl.net> wrote in message
news:Xns9A15870AA5F54eejj99@194.109.133.242...
> Mike Brind wrote on 29 dec 2007 in
> microsoft.public.inetserver.asp.general:
>
>
> Ah yes, I was thinking about parainches or orthoyards,
> but I am glad it turns out to be metric after all.
>
>
> That is what alternative means, though I did not use that word.
>
>
> Please elaborate for us.
>

The main additional benefit is that you don't need to delimit values in
concatenated SQL strings, which removes the source of a number of errors
posted here, such as datatype mismatches and syntax errors. With
parameters, you would still perform server-side validation of values (for
range, datatype etc), but you are right - you don't need to specifically
validate against Sql injection attempts.

--
Mike Brind

Sponsored Links