dbTalk Databases Forums  

please help - mysterious extra characters appearing in SQL update

comp.databases.mysql comp.databases.mysql


Discuss please help - mysterious extra characters appearing in SQL update in the comp.databases.mysql forum.



Reply
 
Thread Tools Display Modes
  #1  
Old   
digger440uk
 
Posts: n/a

Default please help - mysterious extra characters appearing in SQL update - 09-24-2006 , 11:05 AM






This is a real strange problem. I have some asp code (javascript) that
sends a simple update sql command to mysql 5.

my sql is this
UPDATE Users SET YouGotMail = -1 WHERE pas_User = 'Clive'

and when it's sent to the database this is the error

Error Type:
Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)
[MySQL][ODBC 3.51 Driver][mysqld-5.0.21-community-nt]You have an error
in your SQL syntax; check the manual that corresponds to your MySQL
server version for the right syntax to use near '{ call
Exectute('UPDATE Users SET YouGotMail = -1 WHERE pas_User = \'Clive\'')
}' at line 1

Backslash characters have some how been inserted into the string. I
know the sql is ok. Works fine in the MySQL Query Browser. I was
wondering if it something to do with language settings but it's
something i'm new too. However the table Users is set up by english
defaults [latin1] and this kind of query is working fine with all my
other tables.

I've been googling for a solution for the last two weeks and i've come
up with nothing. I'm just hoping that someone has had a similar problem
before.

Regards
AndyB


Reply With Quote
  #2  
Old   
Nicholas Sherlock
 
Posts: n/a

Default Re: please help - mysterious extra characters appearing in SQL update - 09-24-2006 , 09:01 PM






digger440uk wrote:
Quote:
This is a real strange problem. I have some asp code (javascript) that
sends a simple update sql command to mysql 5.

my sql is this
UPDATE Users SET YouGotMail = -1 WHERE pas_User = 'Clive'

Exectute('UPDATE Users SET YouGotMail = -1 WHERE pas_User = \'Clive\'')
It sounds like your environment is trying to save you from SQL injection
by automatically escaping the ' in your queries.

Cheers,
Nicholas Sherlock

--
http://www.sherlocksoftware.org


Reply With Quote
Reply




Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Powered by vBulletin Version 3.5.3
Copyright ©2000 - 2012, Jelsoft Enterprises Ltd.