INSERT into table doesn't work, I can't understand why

Question

I’m trying to insert data (which has been entered by the user through a form) into an access database. I am not getting any errors, however it is not entering the data. Any thought?Please help me

<%      
    dim risposta1
    dim risposta2
    dim risposta3
    dim risposta4
    dim risposta5
    dim risposta6
    dim conn
    dim rs
    dim strsql

    risposta1=request.form("risp1")
    risposta2=request.form("risp2")
    risposta3=request.form("risp3")
    risposta4=request.form("risp4")
    risposta5=request.form("risp5")
    risposta6=request.form("risp6")

    set conn=server.createobject("adodb.connection")
    conn.open "driver={Microsoft Access Driver (*.mdb)};dbq=" & server.mappath("database.mdb")

    strsql="insert into t_risposte(risposta1,risposta2,risposta3,risposta4,risposta5,risposta6) 
        values('" & risp1 & "','" & risp2 &"','" & risp3 & "','" & risp4 & "','" & risp5 & "','" & risp6 & "');" 

    set rs=server.createobject("adodb.recordset")
    rs.open strsql,conn

    response.write  ("<p style='color:white;font-size:20px;text-align:center';>Le tue risposte al questionario sono state registrate</p>")

    set rs=nothing
    conn.close
    set conn=nothing
%>

You’re using the wrong variable names in the `INSERT` statement but you shouldn’t be doing that anyway, you should at the very least be using the `ADODB.Command` object to build a parameterised query. — user692942, Jun 20 '21 at 19:39

score 2 · Answer 1 · answered Jun 20 '21 at 15:43

2

You set the variable risposta1=request.form("risp1") but then in sql string use values('" & risp1 &, which should be values('" & risposta1 &.

answered Jun 20 '21 at 15:43

wazz

4,953
5
20
34

I don't think that's the problem. risp1 is the name I set on the form input so I think risp1 is good, but I am not sure. I tried changing it but it gives me an error so idk... – randomperson Jun 20 '21 at 16:23
1

@wazz is right - randomperson see the real error - the way you have made the sql is very easy to get errors from wrong input. – Aristos Jun 20 '21 at 18:52
@randomperson this is absolutely the problem. The bigger issue is the SQL injection vulnerability by passing form posted values directly into a db `INSERT` statement. – user692942 Jun 20 '21 at 19:36
ok but I don't know how to solve it then, like how should the code look like? Sorry but I am still learning and I really need your help – randomperson Jun 20 '21 at 20:38
@randomperson [this](https://stackoverflow.com/a/22037613/692942) should help. – user692942 Jun 21 '21 at 07:07

INSERT into table doesn't work, I can't understand why

1 Answers1