ASP Programming
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed ForumsProgramming Languages - MoreASP Programming

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old April 25th, 2009, 12:26 PM
chaps15 chaps15 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Apr 2009
Posts: 2 chaps15 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 21 m 21 sec
Reputation Power: 0
Cant limit records from an access database using request.querystring

Im creating an asp page for a simple website to recall records of past projects from an access database. The records within the database have images attached via a different table. Im using jscript to display the pictures, and trying to use Request.QueryString to try and only show the pictures of one project depending on the link clicked by the user. When trying to use Request.QueryString im shown an error:

Microsoft OLE DB Provider for ODBC Drivers (0x80040E10)
[Microsoft][ODBC Microsoft Access Driver] Too few parameters. Expected 1.

The line of code im trying to use is:
strSQL = "SELECT Photo_FileName FROM ProjectPhoto WHERE ProjectPhoto.Photo_ProjectID = " + Request.QueryString;

Any help or suggestions on this would be greatly appreciated

Reply With Quote
  #2  
Old April 25th, 2009, 09:18 PM
Doug G Doug G is online now
Grumpier Old Moderator
Dev Shed God 15th Plane (12000 - 12499 posts)
 
Join Date: Jun 2003
Posts: 12,211 Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level)Doug G User rank is General 15th Grade (Above 100000 Reputation Level) 
Time spent in forums: 1 Month 1 Week 3 Days 3 h 35 m 38 sec
Reputation Power: 1969
You should be using request.querystring("variablename_here"). When you call request.querystring without any qualifier, you get a comma-delimited string of all querystring stuff.

Also it's a bad idea to pass user input directly to a sql query without filtering it for hacks, etc. Copy request.querystring variable to a local variable, then validate it and finally use the validated data in your sql query.
__________________
======
Doug G
======
I didn't attend the funeral, but I sent a nice letter saying I approved of it. --Mark Twain

Reply With Quote
  #3  
Old April 25th, 2009, 09:38 PM
MadDogBrown MadDogBrown is offline
Contributing User
Dev Shed Novice (500 - 999 posts)
 
Join Date: Mar 2009
Posts: 733 MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level) 
Time spent in forums: 1 Week 1 Day 4 h 27 m 8 sec
Reputation Power: 516
Better still, use the ado command object parameters collection.

See the MSDN docs for details.

Reply With Quote
  #4  
Old April 26th, 2009, 06:46 AM
chaps15 chaps15 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
 
Join Date: Apr 2009
Posts: 2 chaps15 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 21 m 21 sec
Reputation Power: 0
Thanks guys, ive now fixed the problem, the querystring variable wasn't initialised properly, so there as nothing for the process to call, hence the expected parameter.

Thanks again

Reply With Quote
  #5  
Old April 26th, 2009, 10:28 AM
MadDogBrown MadDogBrown is offline
Contributing User
Dev Shed Novice (500 - 999 posts)
 
Join Date: Mar 2009
Posts: 733 MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level)MadDogBrown User rank is Colonel (50000 - 60000 Reputation Level) 
Time spent in forums: 1 Week 1 Day 4 h 27 m 8 sec
Reputation Power: 516
Quote:
Originally Posted by chaps15
Thanks guys, ive now fixed the problem, the querystring variable wasn't initialised properly, so there as nothing for the process to call, hence the expected parameter.

Thanks again

If you left the code as-is it will:
1: break when you need to add another querystring variable
2: be wide open to sql injection attacks

That is poorly written code: it behooves you to fix it, as described in this thread.

Reply With Quote
Reply

Viewing: Dev Shed ForumsProgramming Languages - MoreASP Programming > Cant limit records from an access database using request.querystring


Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump




 Free IT White Papers!
 
How to Present Effectively Online
This white paper offers practical and actionable advice on the key steps that any presenter should consider as they plan and execute a Webinar or online meeting.

 
Open Source Security Myths
Open Source Software (OSS) is computer software whose source code is available to the general public with relaxed or non-existent intellectual property restrictions (or arrangement such as the public domain), and is usually developed with the input of many contributors.

 
Power and Cooling Capacity Management for Data Centers
This paper describes the principles for achieving power and cooling capacity management.

 
Scalable, Fault-Tolerant NAS for Oracle - The Next Generation
For several years NAS has been evolving as a storage alternative for Oracle databases, and for good reason: NAS is quite often the simplest, most cost-effective storage approach for Oracle. Learn about the benefits that HP's approach to scalable NAS brings to Oracle environments in this comprehensive white paper.

 
Understanding Web Application Security Challenges
This white paper discusses many common threats and preventive measures for Web application security, and explains what you can do to help protect your organization.

 

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 




© 2003-2009 by Developer Shed. All rights reserved. DS Cluster 5 Hosted by Hostway
Stay green...Green IT