SQL - Updating Empty Text Field is enterring -1

[Aaron Bertrand - MVP]

> "Update [Website Settings] set userid = '" & REquest.form("userid") &

> "' and repid = '" & Request.form("repid") & "' where " & var1 & var2
> & var3

Response.write this to the screen, instead of executing it, and examine the
result.

[Erland Sommarskog]

[posted and mailed, please reply in news]

Scott Hoff (SHOFF@FIRSTHEARTLAND.COM) writes:

> However, when I update the empty fields in this table it places a -1
> into the field rather than the enterred value.
>...
> "Update [Website Settings] set userid = '" & REquest.form("userid") &
> "' and repid = '" & Request.form("repid") & "' where " & var1 & var2
> & var3

If that is all that happens, consider yourself lucky. A malicious
user could use the above for SQL intrusion, and SQL Server to execute
commands you sure did not intend him to. For a starter, enter
O'Brien in userid.

--
Erland Sommarskog, SQL Server MVP, [email]sommar@algonet.se[/email]

Books Online for SQL Server SP3 at
[url]http://www.microsoft.com/sql/techinfo/productdoc/2000/books.asp[/url]