Adding javascript loops into SQL database

Question

What i am trying to achieve is adding the javascript loops and the named variables into an sql database, some of them are already added to an external script so work fine however some which i have named in the SQL script at the bottom still need adding, however as the database won't accept a colon ":" they won't enter it and is returning an error, looking at the code at the bottom with replace function im sure you can see what i am trying to achieve but failing miserably, help is much appreciated!

window.status = 'Loading contingency scripts - please wait...';
audit('Loading contingency scripts');
var conting = {
    i: 0,
    start: function() {
        window.status = 'Loading form - please wait...';
        var t = '';
        t += '<form name="frm_conting" id="frm_conting" onsubmit="return false;">';
        t += '<table width="100%" cellspacing="1" cellpadding="0">';
        t += '<tr><td>Date (DD/MM/YY):</td><td><input type="text" size="8"    value="' + current_date + '" id="date"></td></tr>';

        t += '<tr><td>Time Started:</td><td><select id="timefrom"><option></option>';
        for (h = 8; h < 23; h++) {
            for (m = 0; m < 46; m = m + 15) {
                t += '<option value=' + nb[h] + ':' + nb[m] + '>' + nb[h] + ':' + nb[m] + '</option>';
            };
        };
        t += '</select></td></tr>';

        t += '<tr><td>Time Finished:</td><td><select id="timeto"><option></option>';
        for (h = 8; h < 23; h++) {
            for (m = 0; m < 46; m = m + 15) {
                t += '<option value=' + nb[h] + ':' + nb[m] + '>' + nb[h] + ':' + nb[m] + '</option>';
            };
        };

        t += '</select><tr><td>Extension #:</td><td><input type="text" size="5" value="' + my.extension + '" id="staffid"></td></tr>';
        t += '<tr><td>Desk ID:</td><td><input type="text" size="5" value=' + my.deskid + ' id="desk"></td></tr>';
        t += '<tr><td>Number of calls:</td><td><input type="text" size="5" id="calls"></td></tr>';
        t += '<tr><td>Avid ID:</td><td><input type="text" size="5" id="avid"></td></tr>';
        t += '<tr><td><input type="button" value="Submit" onClick="conting.save()"></td>';
        t += '</table>';
        t += '</form>';

        div_form.innerHTML = t;
        window.resizeTo(400, 385);
        window.status = '';
    },

    save: function() {
        var conting_date = frm_conting.date.value;
        if (!isdate(conting_date)) {
            alert("You have entered an incorrect date.");
            return false;
        };

        var conting_timefrom = frm_conting.timefrom.value;
        var conting_timeto = frm_conting.timeto.value;
        if (conting_timefrom == '' || conting_timeto == '') {
            alert("You need to enter a starting & finishing time.");
            return false;
        };
        if (conting_timefrom > conting_timeto) {
            alert("The time you have entered is after the finish time.");
            return false;
        };

        var conting_staffid = frm_conting.staffid.value;
        if (conting_staffid.length != 5) {
            alert("You have entered an incorrect extension number.");
            return false;
        };

        var conting_desk = frm_conting.desk.value;
        if (conting_desk.length != 5) {
            alert("You have entered an incorrect desk ID.");
            return false;
        };

        var conting_calls = frm_conting.calls.value;
        if (isNaN(conting_calls)) {
            alert("You have not entered amount of calls.");
            return false;
        };

        var conting_avid = frm_conting.avid.value;
        if (isNaN(conting_avid)) {
            alert("You have entered an incorrect avid ID.");
            return false;
        };
        if (conting_avid.length != 5) {
            alert("You have entered an incorrect avid ID.");
            return false;
        };

        conn.open(db["contingency"]);
        rs.open("SELECT MAX(prac_id) FROM practice", conn);
        var prac_id = rs.fields(0).value + 1;
        var prac_timefrom = parseFloat(frm_conting.timefrom.value);
        var prac_timeto = parseFloat(frm_conting.timefrom.value);
        var prac_calls = frm_conting.calls.value;
        var prac_avid = frm_conting.avid.value;
        rs.close();
        var q = "INSERT INTO practice (prac_id, prac_staffid, prac_date, prac_timefrom, prac_timeto, prac_extension, prac_desk, prac_calls, prac_avid) VALUES (" + prac_id + "," + my.id + ", " + current_date + ", " + prac_timefrom + ", " + prac_timeto + ", " + my.extension + ", " + my.deskid + ", " + prac_calls + ", " + prac_avid + ")";
        var q = "UPDATE SELECT practice REPLACE ('isNaN', ':', 'isNull')"

        alert(prac_timefrom);
        rs.open(q, conn);
        conn.close();
    }


};
window.status = '';​

Answer 1

This bit of code looks extremely dubious.

var q = "INSERT INTO practice (prac_id, prac_staffid, prac_date, prac_timefrom, prac_timeto, prac_extension, prac_desk, prac_calls, prac_avid) VALUES (" + prac_id + "," + my.id + ", " + current_date + ", " + prac_timefrom + ", " + prac_timeto + ", " + my.extension + ", " + my.deskid + ", " + prac_calls + ", " + prac_avid + ")";
var q = "UPDATE SELECT practice REPLACE ('isNaN', ':', 'isNull')"

alert(prac_timefrom);
rs.open(q, conn);

1. you should use parameterised queries to avoid SQL injection. Additionally even without any deliberate SQL injection attempts this code will fail if any of the form fields contain the ' character.

2. You are assigning to the variable q twice and aren't executing the result of the first assignment. (And declaring it twice actually?!)

3. There is no syntax such as UPDATE SELECT it would need to be something like UPDATE practice SET SomeColumn = REPLACE (SomeColumn, 'isNaN', 'isNull') presumably except see 4 and 5.

4. I'm not clear what the Replace is meant to be doing anyway. What are the 3 parameters you have given it?

5. It would be better to do the Replace on the value before inserting into the database rather than inserting it wrong then updating it to the new value.