Insert array from query string into SQL 2005

Question

Hi

I am trying to insert an array into SQL with no luck. I get the string from a GPRS device that looks like this:

/WeightBridge.aspx?ReadeID=A1B5A0F5C4E4A1B5A0F5C4E4&TagID=45B6C56A90B645B6C56A90B6,A47B1256A45F0843,B49B1256A45F08FF,30 SEP 2010 21:33:59,I,&Custom=Vehicle Num

All I want to do is to split the TagID array and insert it with the rest of the string into a SQL table. The TagID array must inserted into the following colomns in the DB. TagID, TID, UserMemory, DateTime and Direction. After the insert I just give a response that the insert was successfull or failed. Thank you

My code this far:

Imports System.Data.Sql
Imports System.Data.SqlClient

Partial Class WeightBridge
    Inherits System.Web.UI.Page

Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

    insertValue()


End Sub
Private Sub insertValue()
    Dim sqlConn As New SqlConnection
    Dim strConnection As String
    Dim MyTagID As String
    Dim MyReaderID As String
    Dim MyCustom As String
    Dim MyTagArray As Array
    Dim i As Integer

    'Request TagID Array
    MyTagID = Request("TagID")
    If MyTagID.Length > 0 Then
        'Response.Write(MyTagID)
        'Split TagID Array 
        MyTagArray = Split(MyTagID, ",")
        For i = 0 To UBound(MyTagArray) - 1
        Next
    End If

    Try
    strConnection = "My Connection String"

    sqlConn = New SqlConnection(strConnection)
    Dim InsertCommand As New SqlCommand("INSERT INTO WeightBridge(ReaderID, TagID, TID, UserMemory, DateTime, Direction, Custom) VALUES ( '" & Request("ReaderID") & "', '0','0','0','0','0',  '" & Request("Custom") & "')", sqlConn)
    sqlConn.Open()

    InsertCommand.ExecuteNonQuery()

    sqlConn.Close()

    Catch ex As Exception
        Response.Write("FailedNo")
    End Try

    Response.Write("Success")

End Sub

End Class

Answer 1

There is a comma at the end of your TagID QueryString.

Besides, have a look at following code:

Dim allCols() As String = Request("TagID").Split(","c)
Dim tagID As String = allCols(0)
Dim tID As String = allCols(1)
Dim usermemory As String = allCols(2)
Dim dateTime As String = allCols(3)
Dim direction As String = allCols(4)
'........

You should read this article because you are widely open for sql-injection attacks.