Syntax error in INSERT INTO statement with ASP.NET

Question

Here is the query:

INSERT INTO `users` (username, password, email) VALUES ('testu', 'testp', 'teste')

I am getting this error with the following VB code (ASP):

    username = Request.Form("username")
    password = Request.Form("password")
    email = Request.Form("email")

    Dim conn As OleDbConnection = New OleDbConnection(GetConnectionString())
    Dim comm As OleDbCommand = New OleDbCommand("INSERT INTO users (username, password, email) VALUES ('" & username & "', '" & password & "', '" & email & "')", conn)

    conn.Open()
    comm.ExecuteNonQuery()

What is wrong with this statement? I know the connection string is correct because I have used it throughout the rest of my application.

FYI... your code is open to sql inject... and what is the exact error message your get? — John Sobolewski
– John Sobolewski, Commented Dec 6, 2011 at 12:30
Try this: Dim query as String = "INSERT INTO users (... copying your query. Then edit your question posting query value. As someone said, there could be some strange char in params... — Marco
– Marco, Commented Dec 6, 2011 at 12:38

Community · Accepted Answer · 2017-05-23 10:08:19Z

2

Agree! Always use Parameter (prepared) query and hash salt your password. Read SO thread - Salting Your Password: Best Practices? .

 Dim conn As OleDbConnection = New OleDbConnection(GetConnectionString())
 Dim comm As OleDbCommand = New OleDbCommand("INSERT INTO users (username, [password], email) VALUES (@username,@password,@email)",conn)
 comm.Parameters.Add("@username",OleDbType.Varchar,30).Value=username
 ....

edited May 23, 2017 at 10:08

CommunityBot

11 silver badge

answered Dec 6, 2011 at 12:35

KV Prajapati

94.8k20 gold badges151 silver badges188 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Logan Serman Over a year ago

Like I said it is for a very small school project. I am aware of prepared queries and salting. The problem here is the query I mentioned not working, and I do not believe using parameters will solve that (but I could be wrong).

KV Prajapati Over a year ago

@LoganSerman - Password is reserved word of access database engine so you have to escape. See the edited post. office.microsoft.com/en-us/access-help/…

Logan Serman Over a year ago

Thank you, AVD. That was indeed the problem.

Sergii Kudriavtsev · Accepted Answer · 2011-12-06 12:30:51Z

1

Don't EVER pass parameters to SQL commands with concatenation! This is an open way for SQL injection attack.

You should use placeholders for parameters and add actual values using comm.AddParameter().

As for your error - I'd expect some of your parameter values contains a single quote (').

answered Dec 6, 2011 at 12:30

Sergii Kudriavtsev

10.5k5 gold badges48 silver badges71 bronze badges

Collectives™ on Stack Overflow

Syntax error in INSERT INTO statement with ASP.NET

2 Answers 2

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related