Velocity Reviews

Velocity Reviews (http://www.velocityreviews.com/forums/index.php)
-   ASP General (http://www.velocityreviews.com/forums/f65-asp-general.html)
-   -   Insert into msAccess problems (http://www.velocityreviews.com/forums/t805040-insert-into-msaccess-problems.html)

chumley 02-25-2010 12:14 AM

Insert into msAccess problems
 
I'm using Access dbase for a simple insertion, when i post from my
form page into my insertion script, i get error at the
StrConnz.Execute (StrSql) command line of the query needs to be
updateable type:
Microsoft JET Database Engine error '80004005'
Operation must use an updateable query.
/providerform/fo-add.asp, line 25

'''''''''''''''''
<%@ LANGUAGE="VBSCRIPT"%>
<%Response.Buffer = True%>
<%
dim dsn,StrConnz
dsn="Provider=Microsoft.Jet.OLEDB.4.0; Data Source=" &
Server.MapPath("fo1.mdb")
Set StrConnz = Server.CreateObject("ADODB.Connection")
StrConnz.Open dsn

dim strSql
strSql = "insert into tblMain
(LastName,FirstName,fund,Industry,Company) values ('"
strSql = StrSql & replace(Request.Form("LastName"),"'","''") & "', '"
strSql = StrSql & Request.Form("FirstName") & "', '"
strSql = StrSql & Request.Form("fund") & "','"
strSql = StrSql & Request.Form("Industry") & "', '"
strSql = StrSql & Request.Form("Company") & "')"
StrConnz.Execute (StrSql) %>

not sure why as i am connecting properly to dbase

???
chumley

Bob Barrows 02-25-2010 01:13 AM

Re: Insert into msAccess problems
 
chumley wrote:
> I'm using Access dbase for a simple insertion, when i post from my
> form page into my insertion script, i get error at the
> StrConnz.Execute (StrSql) command line of the query needs to be
> updateable type:
> Microsoft JET Database Engine error '80004005'
> Operation must use an updateable query.
> /providerform/fo-add.asp, line 25
>
> '''''''''''''''''
> <%@ LANGUAGE="VBSCRIPT"%>
> <%Response.Buffer = True%>
> <%
> dim dsn,StrConnz
> dsn="Provider=Microsoft.Jet.OLEDB.4.0; Data Source=" &
> Server.MapPath("fo1.mdb")
> Set StrConnz = Server.CreateObject("ADODB.Connection")
> StrConnz.Open dsn
>
> dim strSql
> strSql = "insert into tblMain
> (LastName,FirstName,fund,Industry,Company) values ('"
> strSql = StrSql & replace(Request.Form("LastName"),"'","''") & "', '"
> strSql = StrSql & Request.Form("FirstName") & "', '"
> strSql = StrSql & Request.Form("fund") & "','"
> strSql = StrSql & Request.Form("Industry") & "', '"
> strSql = StrSql & Request.Form("Company") & "')"
> StrConnz.Execute (StrSql) %>
>

http://www.aspfaq.com/show.asp?id=2062

Further points to consider:
Your use of dynamic sql is leaving you vulnerable to hackers using sql
injection:
http://mvp.unixwiz.net/techtips/sql-injection.html
http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23

See here for a better, more secure way to execute your queries by using
parameter markers:
http://groups-beta.google.com/group/...e36562fee7804e

Personally, I prefer using stored procedures, or saved parameter queries
as
they are known in Access:

Access:
http://www.google.com/groups?hl=en&l...TNGP12.phx.gbl

http://groups.google.com/groups?hl=e...tngp13.phx.gbl



--
Microsoft MVP - ASP/ASP.NET - 2004-2007
Please reply to the newsgroup. This email account is my spam trap so I
don't check it very often. If you must reply off-line, then remove the
"NO SPAM"



Dan 02-25-2010 10:25 AM

Re: Insert into msAccess problems
 

"chumley" <blueberryz99@yahoo.com> wrote in message
news:27439f5d-9992-4ff6-a5aa-d276e2980aaf@t9g2000prh.googlegroups.com...
> I'm using Access dbase for a simple insertion, when i post from my
> form page into my insertion script, i get error at the
> StrConnz.Execute (StrSql) command line of the query needs to be
> updateable type:
> Microsoft JET Database Engine error '80004005'
> Operation must use an updateable query.
> /providerform/fo-add.asp, line 25
>
> '''''''''''''''''
> <%@ LANGUAGE="VBSCRIPT"%>
> <%Response.Buffer = True%>
> <%
> dim dsn,StrConnz
> dsn="Provider=Microsoft.Jet.OLEDB.4.0; Data Source=" &
> Server.MapPath("fo1.mdb")
> Set StrConnz = Server.CreateObject("ADODB.Connection")
> StrConnz.Open dsn
>
> dim strSql
> strSql = "insert into tblMain
> (LastName,FirstName,fund,Industry,Company) values ('"
> strSql = StrSql & replace(Request.Form("LastName"),"'","''") & "', '"
> strSql = StrSql & Request.Form("FirstName") & "', '"
> strSql = StrSql & Request.Form("fund") & "','"
> strSql = StrSql & Request.Form("Industry") & "', '"
> strSql = StrSql & Request.Form("Company") & "')"
> StrConnz.Execute (StrSql) %>
>
> not sure why as i am connecting properly to dbase
>
> ???
> chumley


As well as Bob's recommendation of using parameterised queries, also check
that the ASP application has write permission to the folder that the mdb
file is located in (if not then the database is opened as read only. Is
tblMain a table, or a query? If it's a query, it will be unupdateable if any
of the tables involved don't have a primary key, or if you are using any
joins other than INNER.

--
Dan



All times are GMT. The time now is 11:11 AM.

Powered by vBulletin®. Copyright ©2000 - 2014, vBulletin Solutions, Inc.
SEO by vBSEO ©2010, Crawlability, Inc.