sql server (alternate): I'm trying to do a simple update like I have done countless times
before.

However, when I update the empty fields in this table it places a -1
into the field rather than the enterred value.

It is indexed with duplicates allowed. It says that zero lenght is
set to yes.

What can I do about this?


if Request.form("ouserid") <> "" Then
var2 = " and userid = '" & Request.form("ouserid") & "' "
Else
var2 = " and userid is null "
End if
if Request.form("orepid") <> "" Then
var1 = " repid = '" & Request.form("orepid") & "'"
Else
var1 = " repid is null "
End if

"Update [Website Settings] set userid = '" & REquest.form("userid") &
"' and repid = '" & Request.form("repid") & "' where " & var1 & var2
& var3

[quoted text, click to view]

Response.write this to the screen, instead of executing it, and examine the
result.

[posted and mailed, please reply in news]

Scott Hoff (SHOFF@FIRSTHEARTLAND.COM) writes:
[quoted text, click to view]

If that is all that happens, consider yourself lucky. A malicious
user could use the above for SQL intrusion, and SQL Server to execute
commands you sure did not intend him to. For a starter, enter
O'Brien in userid.

--
Erland Sommarskog, SQL Server MVP, sommar@algonet.se

Books Online for SQL Server SP3 at