MerchAffil — Thu, 08 Dec 2005 10:07:04 +0000

Hey

All fixed now

I would like to thank you very much for your help

Murray

chrishirst — Tue, 06 Dec 2005 23:59:37 +0000

It depends which field may have "'" in it

It's simply a function and you would pass your string variable through it

strVar = stripQuotes(strVar)

MerchAffil — Mon, 05 Dec 2005 14:59:04 +0000

Thannks so much for your help!!

Sorry - beginner.

Where does the above go?

Murray

<?php
 Set Upload = Server.CreateObject("Persits.Upload.1")

    dim Upload, File, Item
   

    Upload.Save "......."
    
    

dim WP, references, title, name1, name2, name3, pob, nat, noc, mmn, sex, email, marital, passport, passportissue, driving, drivingissue, mobile, home, add1, add2, town, post, dob, ni, sales, airport, full_part, pth, GCSE, nameofemployer1, jobtitle1, jobdes1, leaving1, start1, leavingdate1, nameofemployer2, jobtitle2, jobdes2, leaving2, start2, leavingdate2, nameofemployer3, jobtitle3, jobdes3, leaving3, start3, leavingdate3, whichairport, airportbefore, location, company, start4, leavingdate4, cdescription, miles, Jtime, home2, car, criminal, shifts, student, studenthours, appropriate, where1, comments
Dim objConn, strQ, objRS


WP = Upload.form("WP")
references = Upload.form("references")
title = Upload.form("title")
name1 = Upload.form("name1")
name2 = Upload.form("name2")
name3 = Upload.form("name3")
pob = Upload.form("pob")
nat = Upload.form("nat")
noc = Upload.form("noc")
mmn = Upload.form("mmn")
sex = Upload.form("sex")
marital = Upload.form("marital")
email = Upload.form("email")
passport = Upload.form("passport")
passportissue= Upload.form("passportissue")
driving = Upload.form("driving")
drivingissue= Upload.form("drivingissue")
mobile = Upload.form("mobile")
home = Upload.form("home")
add1 = Upload.form("add1")
add2 = Upload.form("add2")
town = Upload.form("town")
post = Upload.form("post")
dob = Upload.form("dob")
ni = Upload.form("ni")
sales = Upload.form("sales")
airport = Upload.form("airport")
full_part = Upload.form("full_part")
pth = Upload.form("pth")
GCSE = Upload.form("GCSE")
nameofemployer1 = Upload.form("nameofemployer1")
jobtitle1 = Upload.form("jobtitle1")
jobdes1 = Upload.form("jobdes1")
leaving1 = Upload.form("leaving1")
start1 = Upload.form("start1")
leavingdate1 = Upload.form("leavingdate1")
nameofemployer2 = Upload.form("nameofemployer2")
jobtitle2 = Upload.form("jobtitle2")
jobdes2 = Upload.form("jobdes2")
leaving2 = Upload.form("leaving2")
start2 = Upload.form("start2")
leavingdate2 = Upload.form("leavingdate2")
nameofemployer3 = Upload.form("nameofemployer3")
jobtitle3 = Upload.form("jobtitle3")
jobdes3 = Upload.form("jobdes3")
leaving3 = Upload.form("leaving3")
start3 = Upload.form("start3")
leavingdate3 = Upload.form("leavingdate3")
whichairport = Upload.form("whichairport")
airportbefore = Upload.form("airportbefore")
location = Upload.form("location")
company = Upload.form("company")
start4 = Upload.form("start4")
leavingdate4 = Upload.form("leavingdate4")
cdescription = Upload.form("cdescription")
miles = Upload.form("miles")
Jtime = Upload.form("Jtime")
home2 = Upload.form("home2")
car = Upload.form("car")
criminal = Upload.form("criminal")
shifts= Upload.form("shifts")
student= Upload.form("student")
studenthours = Upload.form("studenthours")
appropriate = Upload.form("appropriate")
where1 = Upload.form("where1")

 For Each File in Upload.Files

     
      File.Copy "........ & File.ExtractFileName
      comments = File.ExtractFileName
      File.Delete
    Next

    ' Display description field
    'Response.Write Upload.Form("Description") & "<BR>"

    ' Display all selected categories
    For Each Item in Upload.Form
      If Item.Name = "Category" Then
        Response.Write Item.Value & "<BR>"
      End If
    Next


    Dim insertSql
                Set objConn = Server.CreateObject("ADODB.Connection")
                objConn.Open = strConnection
                'insertSql = "INSERT INTO forward (u_id, f_email, f_name) VALUES (" & intUid & " , " & strToemail & " , " & strFname & " )" 
    
                'insertsql = "insert into forward (u_id, f_email, f_name)"
                'insertsql = insertsql & " values( " & intUid & " , '" & strToemail & "' , '" & strFname & "' )" 
                
'insertsql = "insert into preference (Title, Firstname) values( '" & Title & "' , '" & Firstname & "' )"
insertSql = ""

insertSql = insertSql & "INSERT INTO users_tbl"

insertSql = insertSql & "(WP, references, title, name1, name2, name3, pob, nat, noc, mmn, sex, marital, email, passport, passportissue, driving, drivingissue, mobile, home, add1, add2, town, post, dob, ni, sales, airport, full_part, pth, GCSE, nameofemployer1, jobtitle1, jobdes1, leaving1, start1, leavingdate1, nameofemployer2, jobtitle2, jobdes2, leaving2, start2, leavingdate2, nameofemployer3, jobtitle3, jobdes3, leaving3, start3, leavingdate3, whichairport, airportbefore, location, company, start4, leavingdate4, cdescription, miles, Jtime, home2, car, criminal, shifts, student, studenthours, appropriate, where1, FILE1  ) " & vbCrLf






insertSql = insertSql & "VALUES ("

insertSql = insertSql & "'" & WP & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & references & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & title & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & name1 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & name2 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & name3 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & pob & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & nat & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & noc & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & mmn & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & sex & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & marital & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & email & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & passport & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & passportissue & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & driving & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & drivingissue & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & mobile & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & home & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & add1 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" &  add2 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & town & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & post & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & dob & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & ni & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & sales & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & airport & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & full_part & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & pth & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & GCSE & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & nameofemployer1 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & jobtitle1 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & jobdes1 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & leaving1 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & start1 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & leavingdate1 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & nameofemployer2 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & jobtitle2 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & jobdes2 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & leaving2 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & start2 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & leavingdate2 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & nameofemployer3 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & jobtitle3 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & jobdes3 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & leaving3 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & start3 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & leavingdate3 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & whichairport & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & airportbefore & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & location & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & company & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & start4 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & leavingdate4 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & cdescription & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & miles & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & Jtime & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & home2 & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & car & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & criminal & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & shifts & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & student & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & studenthours & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & appropriate & "'"
insertSql = insertSql & ", "
insertSql = insertSql & "'" & where1 & "'"

insertSql = insertSql & ", "
insertSql = insertSql & "'" & comments & "'"





insertSql = insertSql &  ");"
'response.write insertSql

                objConn.Execute(insertSql)
                objConn.close
                Set objConn = Nothing
                
Response.write "Data added"
?>

chrishirst — Sun, 04 Dec 2005 08:47:38 +0000

Use another apostrophe

stringOut = replace(stringIn,"'","''")'

or as a function

function stripQuotes(strWords)
'strip out single quotes for SQL injection attempts 
stripQuotes = replace(strWords, "'", "''")
stripQuotes =  StripChars(stripQuotes)
end function 
'***********************************
function StripChars(strIn) 
dim Disallowed 
dim strOut 
dim i
Disallowed = array("select", "drop", ";", "--", "insert","delete", "xp_") 
strOut = strIn 
for i = 0 to uBound(Disallowed) 
strOut = replace(strOut, Disallowed(i), "") 
next 
StripChars = strOut 
end function 

I've include a function for helping prevent SQL injection as well.

Greg K — Sat, 03 Dec 2005 18:58:59 +0000

I know for PHP there are functions to process strings to escape out characters like quotes (ie. How'd they do that would be How\'d they do that )

I can't remember if ASP does escaping or doubling of the quotes. BJA knows ASP, so perhaps he will be able to post an answer for you. Until then try searching in ASP help for the term "escaping quotes".

-Greg