Re: How to store the HTML code into database(microsoft access)

  •  07-24-2008, 4:53 PM

    Re: How to store the HTML code into database(microsoft access)

    Never use DYNAMIC SQL to insert text data... NO GOOD, I say NO GOOD, very BAD...

    THIS IS NO GOOD: conn.execute("INSERT INTO tblmemo([memo]) values ('" & Request.Form("editor1")& "')")
     
    Your Request.Form("editor1") value will include invalid caracters like single quotes (') and double quotes (") and will create SQL INSERT Errors. But most important... you could be victim of SQL INJECTION read more here: http://en.wikipedia.org/wiki/SQL_injection 
     
    This is why I've wrote a regular recordset, that way it will work, just take my code and change it to your values...   

    Set rs_page = Server.CreateObject("ADODB.Recordset")
                rs_page.ActiveConnection = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath("database/dbmemo.mdb")
                rs_page.Source = "Select top 1 * from tblmemo; "
                rs_page.CursorType = 3
                rs_page.CursorLocation = 2
                rs_page.LockType = 1
                rs_page.Open()
                    
                rs_page.addNew    
                   rs_page("memo") = Request.Form("editor1") 
                rs_page.update    
                
                rs_page.close    
          Set rs_page = nothing

    But for your info, this forum is not for ASP tutorials, if you need CLASSIC ASP TUTORIALS, here is some good link;

    http://www.w3schools.com/asp
    http://www.4guysfromrolla.com
    http://www.aspin.com/home/tutorial

    Filed under:
View Complete Thread