SQL/ASP - Expected: " - But it's there?

Question

hey all,

can somebody please help me figure this out? It's giving me error after error after error and I have no idea what its problem is.

My code:

<%
Dim cnnSimple  ' ADO connection
Dim rstSimple  ' ADO recordset
Set cnnSimple = Server.CreateObject("ADODB.Connection")
' DSNLess
cnnSimple.Open "MY CONNECTIONS STRING INFO HERE"

cnnSimple.Execute("insert into SALT (Email, Username, FirstName, LastName, ActivationCode) VALUES ('" & Request.QueryString("payer_email") & "', '" & Request.QueryString("payer_email") & "', '" & Request.QueryString("first_name") & "', '" & Request.QueryString("last_name") & "', '" & Request.QueryString("hash") & "')")

rstSimple.Close
Set rstSimple = Nothing
cnnSimple.Close
Set cnnSimple = Nothing
%>

And the error:

Microsoft VBScript runtime error '800a01a8'
Object required: ''
/thanks.asp, line 65

Thank you

Line 65 is:

cnnSimple.Execute("insert into SALT (Email, Username, FirstName, LastName, ActivationCode) VALUES ('" & Request.QueryString("payer_email") & "', '" & Request.QueryString("payer_email") & "', '" & Request.QueryString("first_name") & "', '" & Request.QueryString("last_name") & "', '" & Request.QueryString("hash") & "')")

Answer 1

The error implies the use of an object that hasn't been instantiated. From the code snippet given, it looks like you're attempting to close the recordset without ever instantiating it.

Do you mean to be setting rstSimple to the result of cnnSimple.Execute()?

Edit: Now that I've looked at the other question, what I've suggested may not be the problem. As people have pointed out, you should really clean the data in the Request object before inserting it in your string (security or no security, an apostrophe in one of those vars will kill that statement).

It's possible (my memories of VBScript are blissfully hazy) that if the Execute() statement fails, nothing will be assigned to rstSimple, and the call to rstSimple.Close() will generate the error message you're seeing.

Try setting rstSimple to a new ADODB.Recordset before calling cnnSimple.Execute() and see if that sheds any light on the issue...

Answer 2

suggestion:

1. declare a string variable (myVar)

2. set the string variable = your line 65 SQL

   "insert into SALT (Email, Username, FirstName, LastName, ActivationCode) VALUES ('" & Request.QueryString("payer_email") & "', '" & Request.QueryString("payer_email") & "', '" & Request.QueryString("first_name") & "', '" & Request.QueryString("last_name") & "', '" & Request.QueryString("hash") & "')"

3. response.write(myVar)

Might be easier to look at that way, to see if you have issues with quotes in your querystring variables, or whatever. Once you're happy with it:

1. cnnSimple.Execute(myVar)