Re: Microsoft JET Database Engine error '80040e10'

TonnyD wrote on Tue, 27 Nov 2007 19:47:43 -0800 (PST):

Im not to knowledgeable about asp script so I need a little help. Im
trying to install asppoll and im getting this error;



Microsoft JET Database Engine error '80040e10'

No value given for one or more required parameters.

/asppoll/vote.asp, line 14

This error occurs if you use an object name that isn't present in your
database.


This is the script.<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

<!--#include file="dbconnection.inc"-->
<!--#include file="header.inc"-->
<%

ID = Clng(Request.querystring("ID"))

strSQL = "SELECT * FROM tblIP WHERE IP = '" &
request.servervariables("remote_addr") & "' AND pollID=" & ID
SET rsPoll = adoCon.execute(strSQL)


IF rsPoll.EOF Then

rsPoll.close strSQL="UPDATE tblCount SET " &
Request.Form("txtOption") & "
= " & Request.Form("txtOption") & " + 1 WHERE ID = " & ID

Ugh, look up SQL Injection on Google.

SET rsPoll=adoCon.execute(strSQL)
<<<<<<<<<<<<<<<<<[Line 14]>>>>>>>>>>>>

What is the value of Request.Form("txtOption")? If you print that out, that
should give a hint as to what the problem is as that is the name of the
column in the SQL. Put a Reponse.Write strSQL above this, and see what the
output is.


Dan


.

Relevant Pages

  • Re: submitted data not updated promptly with ms access
    ... therefore, before writing to the database, i ... using sql injection ... Using an expensive recordset to run a query that does not retrieve ... is what I suspect you want to do, although I don't really know why you wish ...
    (microsoft.public.inetserver.asp.db)
  • RE: SQL injection from within a table - is it possible?
    ... I would assume that all parsers would parse the /entire/ sql query ... Suppose your username was "bob", ... Going back to your initial question about a "stored" SQL Injection ... Is it possible to store an SQL injection string into a MSSQL database ...
    (Pen-Test)
  • Re: Single quote
    ... performance and SQL injection issues. ... >> value for column b has a single quote and causing problem. ... > database without modifying the original data, ... > up ALL the applications that hit the database. ...
    (microsoft.public.vb.general.discussion)
  • Re: Database security - PHP code
    ... >prevent SQL injection into a database, ... The injected code could still start its ... uses it again in another query. ...
    (comp.lang.php)
  • Re: Beginner Question: Define PHP "framework" for me
    ... > I've just grabbed a PHP book and can deal with the syntax and now I ... > What are the major framework flavors? ... methods in the class to interact with _whatever_ database it is. ... // Protect from SQL Injection / Cross scripting attacks ...
    (comp.lang.php)