SQL with asp classic

Question

I'm creating a website for my and am struggling with the SQL parts, below are two separate statements I am struggling with, if you know what could be the problem with any of them id appreciate it.

This is the statement

readsql = "SELECT * FROM Gallery WHERE <%=GalleryRs ("img_USERID")%> = <%=session ("usr_ID")%>"

This is the error

Expected end of statement

/WIP/Gallery.asp, line 20

readsql = "SELECT * FROM Gallery WHERE <%=GalleryRs ("img_USERID") ------------------------------------------------------^

This is the second statement

INSERT INTO like (lik_POSTID) VALUES('" &_
request("pos_ID") & "')

and the error

Microsoft Access Database Engine error '80040e14'

Syntax error in INSERT INTO statement.

/student/S0190204/WIP/like.asp, line 56

If you can help with either one that would be grand, thanks

Answer 1

Try

readsql = "SELECT * FROM Gallery WHERE "& GalleryRs("img_USERID")&" = "& session("usr_ID")

<%= %> makes no sense within an asp code block. It's for when you want to embed an asp variable within your html code - the "=" sign is shorthand for Response.Write - eg

<h1><%= pagetitle %></h1>

Also note that I've taken out the spaces after "GalleryRs" and "Session"

Edited

readsql = "SELECT * FROM Gallery WHERE "& GalleryRs("img_USERID")&" = '"& session("usr_ID") & "'"

Answer 2

Your select sql should look like this when it gets to the database:

select *
from Gallery
where img_UserId = something

You are sending:

select * 
from Gallery
where <%= etc

Your field name does not include <%. Look at why you are using a variable there. Unless the field in your where clause is not the same everytime, don't use a variable.

Answer 3

readsql = "SELECT * FROM Gallery WHERE <%=GalleryRs ("img_USERID")%> = <%=session ("usr_ID")%>"

should be

readsql = "SELECT * FROM Gallery WHERE " & GalleryRs("img_USERID") & " = " & session ("usr_ID")

I agree with Dan, why use a variable for your field name? Besides that, this code has a very high level of 'sql injection friendliness'. At least verify what the values in GalleryRs("img_USERID") and session ("usr_ID") are (convert to int or check length). Better is to move this to a stored procedure!