Asp database question

yeraulone

Hi All,

I'm having a bit of a problem inserting some info into a database. Heres my code:

<%
dim strFirst
dim strEmail

strFirst = Request.Form("name")
strEmail = Request.Form("email")

Response.Write(strFirst) & "<br>"
Response.Write(strEmail)


MyPath=Server.MapPath("emails_names.mdb")
Set conn = Server.CreateObject("ADODB.Connection")
conn.Open "Driver={Microsoft Access Driver (*.mdb)};" & _
"DBQ=" & MyPath

SQL = "INSERT INTO details (Name, Email) VALUES ('"&strFirst&"','"&strEmail&"')"
conn.Execute(SQL)
%>


and heres the error message:

"Microsoft OLE DB Provider for ODBC Drivers (0x80004005)
[Microsoft][ODBC Microsoft Access Driver] Operation must use an updateable query.
/flash_capture/project3/processForm.asp, line 21"


Line 21 is conn.Execute(SQL). I'm fairly new to asp so I apologise if the error is blindingly obvious.

Thanks

Serbian

I'm pretty sure that this is a permissions issue. You need to give write permissions to the Internet Guest User (IUSR_<computer name>) account on the access database, emails_names.mdb.

Just in case you are not sure how to do this, open up My Computer and choose Tools -> Folder Options. Click View and scroll to the very bottom and make sure simple file sharing is not ticked. Then right click on the file and choose properties. Choose the Security Tab and click Add. For the Object name type IUSR_<computer name> and click check names. It should find the Internet Guest User. Click OK then click in the IUSR account and click read and write permissions.

yeraulone

Thanks serbian - thats fixed.

Eoin

Hi,

I know this is totally OT and you have probably done this anyway, but remember to escape single quotes - especially when you are dealing with name fields, and even more especially when you are dealing with Irish names!

regards,

Eoin

Function formatFormText(sText)
	sText = "" & sText  'should handle null values now
	sText = Replace(sText, "'", "''")
	formatFormText = sText
End Function

strFirst = FormatFormText(Request.Form("name"))
strEmail = FormatFormText(Request.Form("email"))

yeraulone

thanks eoin - Ill add that.

Seth Brundle

in addition - you should escape all fields, not just name fields.
You should also trap characters such as <. >, [, ], and possibly also possible SQL statements, etc.

rsynnott

eoin_s wrote:

Hi,

I know this is totally OT and you have probably done this anyway, but remember to escape single quotes - especially when you are dealing with name fields, and even more especially when you are dealing with Irish names!

regards,

Eoin

Ah, someone beat me to it