Question

Here is the query:

INSERT INTO `users` (username, password, email) VALUES ('testu', 'testp', 'teste')

I am getting this error with the following VB code (ASP):

    username = Request.Form("username")
    password = Request.Form("password")
    email = Request.Form("email")

    Dim conn As OleDbConnection = New OleDbConnection(GetConnectionString())
    Dim comm As OleDbCommand = New OleDbCommand("INSERT INTO users (username, password, email) VALUES ('" & username & "', '" & password & "', '" & email & "')", conn)

    conn.Open()
    comm.ExecuteNonQuery()

What is wrong with this statement? I know the connection string is correct because I have used it throughout the rest of my application.

Answer 1

Agree! Always use Parameter (prepared) query and hash salt your password. Read SO thread – Salting Your Password: Best Practices? .

 Dim conn As OleDbConnection = New OleDbConnection(GetConnectionString())
 Dim comm As OleDbCommand = New OleDbCommand("INSERT INTO users (username, [password], email) VALUES (@username,@password,@email)",conn)
 comm.Parameters.Add("@username",OleDbType.Varchar,30).Value=username
 ....