EMail\SQLError

  • Thread starter Thread starter gh
  • Start date Start date
G

gh

Below is the from part of an sql statement. When the query is fired
from the web page I get the following error. How do I work around this?

Thanks




Token unknown - line 1, char 67 @




from USERLOGIN WHERE LOGIN= " +aEmail+ " AND PSSWORD=
 
gh said:
Below is the from part of an sql statement. When the query is fired
from the web page I get the following error. How do I work around this?

Thanks

Token unknown - line 1, char 67 @

from USERLOGIN WHERE LOGIN= " +aEmail+ " AND PSSWORD=
Click to expand...

You should use a prepared statement or a stored procedure. The way you
build the sql command is open to sql injection. Just think what'll
happen is "aEmail" is: ..."; delete from userlogin;"... or something
like that.

Best,
Hilmar
 
try using single quotes around the variable in your where clause

example:

from USERLOGIN WHERE login ='" + aEmail + "'

I assume, aEmail is a string variable in your .net code.

Regards,
Augustin
 
Back
Top