Error executing sql expression ASP

Question

I'm attempting to use a variable for the column field in the SQL statement however it shoots back the following error at me:

Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

[Microsoft][ODBC Text Driver] Syntax error (missing operator) in query expression '= 'Yes''.

/junk/dbresults.htm, line 31

THE CODE:

<%
    Dim connectString, connect, conDB, con
    connectString = "Driver={Microsoft Text Driver (*.txt; *.csv)}; DBQ=" & Server.MapPath("data")
          src_abn = Request.QueryString("abn")
          src_cat = Request.QueryString("cat")
    set connect = Server.CreateObject("ADODB.connection")
    connect.open connectString

    if src_abn = "all" then
    conDB = "SELECT * FROM cont.csv WHERE " & src_cat & " = 'Yes'"  
    else
    conDB = "SELECT * FROM cont.csv WHERE ucase(abn) LIKE ucase('%"+src_abn+"%')"   
    end if

    set con = connect.execute(conDB)
%>

squillman squillman · Accepted Answer · 2013-01-09T21:21:07

Looks like the value of src_cat contains spaces or other characters that create an invalid query. Try changing that line to this (with brackets):

conDB = "SELECT * FROM cont.csv WHERE [" & src_cat & "] = 'Yes'"

Error executing sql expression ASP

2 Answers