NodeReaper has asked for the wisdom of the Perl Monks concerning the following question:

  • Comment on (duplicate) Insert into SQL 2000 from form on web

Replies are listed 'Best First'.
Re: Insert into SQL 2000 from form on web
by dws (Chancellor) on Jul 14, 2003 at 21:57 UTC
    I don't have SQL Server docs within reach, but the syntax you're using for INSERT looks off. Try
    INSERT INTO todo (date,status,content) VALUES (?,?,?)
    and plug in the pieces. Also, consider adding some error checking. Some of those DBI calls are probably failing on you, leaving helpful error messages that you aren't bothering to look at.

Re: Insert into SQL 2000 from form on web
by roju (Friar) on Jul 14, 2003 at 22:13 UTC
    I didn't mention this in my first post, but it's important enough that I'm mentioning it now. Not directly related to your question, but very important.

    insert_item ($dbh, param ("content")); is very very very dangerous, since you never validate content other than by stipping whitespace. You're opening yourself up to SQL injection (see first Google hit,OWASP summary).

    If you're doing web app development, make sure to read the papers on OWASP, it's an amazing resource. SQL Injection and Cross-site Scripting are the usual points of attack for a webapp. Definately take the time to enderstand them. Remember, never trust the user.

Re: INSert into SQL 2000 from formon web
by roju (Friar) on Jul 14, 2003 at 21:51 UTC
    Have you tried using the MS Query Analyzer? Run your update in it and see what happens. It looks to me like your insert statement should be INSERT INTO prodreg VALUES ($stmt), rather than INSERT INTO prodreg SET ($stmt); I'm no SQL wizard though.