Asp Classic Sql Query With Two Parameters

This is SQL Query in ASP Classic: mQry = 'SELECT DISTINCT name FROM best WHERE invoice_num = ' & request.querystring('invoice_num') & ' AND name LIKE '%' & request.que

Solution 1:

Most likely you have self-referencing form (i.e. targeting the same page) and you don't check if the form was submitted before executing that code.

This code will perform such a check, plus have better protection against SQL Injection attacks:

Dim invoiceNumber
invoiceNumber = Request.QueryString("invoice_num")
If Len(invoiceNumber)>0 And IsNumeric(invoiceNumber) Then
    invoiceNumber = CLng(invoiceNumber)
    If invoiceNumber>0 Then
        mQry = "SELECT DISTINCT name FROM best WHERE invoice_num = "  & invoiceNumber & " AND name LIKE '%" & Replace(Request.Querystring("org_name"), "'", "''") & "%'"
        '...rest of the code here...
    End If
End If

Solution 2:

Request.QueryString("myval") reads a URL parameter called "myval".

So if you had a page called mypage.asp then you could specify parameters to it in the URL like this:

mypage.asp?myval=test1234

So with the above URL, if you call Request.QueryString("myval") is will return "test1234".

When you run your ASP page, are you sure you are specifying URL parameters for the two parameters in your query? It sounds like they are blank. This is ok for a string, but will fail for a numerical value.

Invoice_num and org_name should both be specified in the URL.