Question

I have a variable that is an IP address. It is saved as text in my Access 2010 database. I am trying to run this query with ipSrc and the query always fails. My guess is that its seeing ipSrc as ipSrc and not as the actual IP address. I tried it with ‘ipSrc’ and just plain ipSrc and both reurn fail. Also tried “”ipSrc””, failed as well. This failed to. ‘&ipSrc’. Here is the statement.

SQLCHAR* query = (SQLCHAR*)"SELECT tblIP.[IPAddress], tblIP.[IPType], tblIP.[IPStatus], tblIP.[IPMax] FROM tblIP WHERE tblIP.[IPAddress]= ipSrc AND tblIP.[IPType]=3 AND tblIP.[IPStatus]=1 AND tblIP.[IPMax]=0;"; 

and here is the definition of ipSrc.

translate_ip(ip_header->source_ip, ipSrc);

Using printf it prints out as an actual IP address.

printf("\n   Source      IP: %s", ipSrc);

Answer 1

There’s no way for the code to know, from what you have there, that ipSrc should be treated specially, it’s just going to pass it through as-is.

You can probably try to construct the query string dynamically as a C++ string, and then use that to populate the query. Something like:

std::string strqry =
      "SELECT  tblIP.[IPAddress], "
    + "        tblIP.[IPType], "
    + "        tblIP.[IPStatus], "
    + "        tblIP.[IPMax] "
    + "FROM    tblIP "
    + "WHERE   tblIP.[IPAddress] = '" + ipSrc + "' "
    + "AND     tblIP.[IPType] = 3 "
    + "AND     tblIP.[IPStatus] = 1 "
    + "AND     tblIP.[IPMax] = 0"
    + ";"; 

SQLCHAR *query = (SQLCHAR *)(strqry.c_str());

// Now use query

And make sure you have control over the ipSrc value. Otherwise, you’re subject to SQL injection attacks (in which case you’ll want to use prepared/parameterised statements).