views:

47

answers:

1

This is strange. In the news details page, I want to take a few different values from different tables with one query. However, for some strange reason, I only get two values back. So the outcome is like:

<Desc></Desc>
<Date/>
</row>
</rows>

If I disable fullname, then I get shortdesc but not others. Same things happens with others.

NewsID = Request.QueryString("NEWSID")  

SQL = "SELECT N.NewsID, N.MembersID, N.CategoriesID, N.ImagesID, N.NewsTitle, N.NewsShortDesc, N.NewsDesc, N.NewsActive, N.NewsDateEntered, C.CategoriesID, C.CategoriesName, M.MembersID, M.MembersFullName"

Set objViewNews = objConn.Execute(SQL)  

With Response
    .Write "<?xml version='1.0' encoding='windows-1254' ?>"
    .Write "<rows>"
End With

With Response
    .Write "<row id='"& objViewNews("NewsID") &"'>"
    .Write "<FullName>"& objViewNews("MembersFullName") &"</FullName>"
    .Write "<CategoryName>"& objViewNews("CategoriesName") &"</CategoryName>"
    .Write "</row>"
End With

With Response
    .Write "</rows>"
End With    

objViewNews.Close
Set objViewNews = Nothing
A: 
Thomas
even though all fields are nullable, neither fields are empty.
zurna
also I am pretty sure that NewsID is an integer so I dont think I need to check it with a function. I just used the codes you wrote, same result??
zurna
There one and only one row result from the query and if you Response.Write the all values directly, it outputs something for each value? You should always check values that go into any query even if you think you know it will be an integer in order to protect against SQL Injection (or even to let people know you are protecting against SQL Injection).
Thomas
zurna
BTW, you are checking *all* the values right not just ShortDesc and Fullname? You have tried Response.Write on all the values directly (i.e., not concatenated with anything) and they all output a value?
Thomas
Actually, the output you showed me work correctly. CategoryName is clearly null in your query.
Thomas
@zurna: you still need to check your inputs... I could use a query string like `...DROP TABLE News;--` and drop your News table on you. You should maybe have a read of this: http://en.wikipedia.org/wiki/SQL_injection
Alconja
I tried wrapping all fields in CDATA before. CategoriesName is definitely not null. It seems one query will not do it for me. I will divide it to 3 queries, I am sure it will work then. But thank you so much for trying it with me.
zurna
While you're at it, put that big ugly query in a stored procedure.
David Lively