If statement error on null string value

Question

<html>
<title>Test</title>
<body bgcolor="FFFFFF">

<%
sort = CStr(Request("sort"))
search = CStr(Request("search"))
Set conn = Server.CreateObject("ADODB.Connection")
conn.open "Provider=SQLOLEDB.1;Password=123;Persist Security Info=True;User   ID=sa;Initial Catalog=asdf;Data Source=WIN-123"

Set rs = Server.CreateObject("ADODB.Recordset")
If sort = "ascending" Then
SQL = "select top 50 * from asdf order by Name"
ElseIf (search Is Not Nothing)
SQL = "select * from asdf WHERE name = '" & search & "'"
Else
SQL = "select top 50 * from asdf"
End If
rs.open SQL, conn
%>
<center><form acion="index.asp">
Search Name:<input name="search" /><input type="submit" value="Submit" />
</form></center>

I'm getting an error on my

Else If (search Is Not Nothing)

line, from what I can tell it should work. and of course I also cannot for some reason browse my site on my server to see what the actual error is.

Do not use string concatenation to include parameters. Use parameterized queries instead. You probably want to avoid using the "sa" user logon on SQL server too. Currently your code could exposes your site and network to all manner of malicious attacks. Search "SQL Injection". — AnthonyWJones
– AnthonyWJones, Commented Aug 24, 2012 at 9:18

Passerby · Accepted Answer · 2012-08-24 05:13:11Z

1

Tested on my IIS 5, without option explicit, when you use

search=CStr(Request("search"))

your search has been initialized to string (VarType: 8).

So even if search is "empty", you can not use IsEmpty or similar function/statement to see if it's empty. Use

ElseIf search<>"" Then

directly.

Also, remember to sanitize your SQL queries...

answered Aug 24, 2012 at 5:13

Passerby

10.1k2 gold badges37 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

AnthonyWJones Over a year ago

"sanitize your SQL queries" what does that mean? How is it done?

Passerby Over a year ago

@AnthonyWJones It simply means "avoid SQL injections and stuffs".

Brent Hacker Over a year ago

AnthonyWJones I used a regex with a alphanumeric pattern and a regex.replace on my input variables. Here is what I used: 4guysfromrolla.com/ASPScripts/…

Collectives™ on Stack Overflow

If statement error on null string value

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related