Hey everyone. I've been looking at this code forever and I can't figure it out.
I am trying to delete a record from a database, and I can get the ID to pass successfully, because Ic an see it up in the address bar, but I can't get it to actually delete.

When I run it I get this error:

Microsoft JET Database Engine error '80040e14'
Syntax error (missing operator) in query expression 'annuityID='.
/backend/delete_record.asp, line 29


I know there is simple solution but obviously it isnt simple for me, because I am pulling my hair out over this one. Here is the ASP I'm using:


<%
'declare your variables
Dim Connection, sConnString
Dim sSQL, id

'get the id of the record sent through the querystring of the hyperlink
id=request.querystring("annuityID")

'Create an ADO connection object
Set Connection = Server.CreateObject("ADODB.Connection")

'define the connection string, specify database
'driver and the location of database
sConnString="PROVIDER=Microsoft.Jet.OLEDB.4.0;" & _
"Data Source=omitted"
dsn="dsn=omitted"

'Open the connection to the database
Connection.Open(sConnString)

'declare SQL statement that will query the database
'and which will be deleting the record with the id sent
sSQL="DELETE FROM tbl_annuity WHERE annuityID=" &id
'execute the SQL statement
Connection.execute(sSQL)

response.write "<div align='center'>The record was deleted.</div>"

'close the connection
connection.Close
Set connection = Nothing
%>


Feel free to abuse me with your words, but any help that you could offer would be greatly appreciated.


Thanks,
Alex

How about if I just kicked you in the groin instead?

The problem is that what you said is happening (querystring getting passed) isn't actually happening:

id=request.querystring("annuityID")

What is the value of ID when that querystring is passed? Probably null.

If you want to debug it to see if it's getting erased somewhere (i.e. if those pieces of code you posted were in subprocedures or something, use Response.Write id at various points to help you figure out where it gets erased.

Remember, in order for ID to get passed, your URL has to be of the form http://www.your-site.com/your-page.a...uityID=1234567 .

A few other small pointers:

1) You should have your script say id=CLng (Request.QueryString ("annuityID")) . This will allow your script to convert the id to an integer and prevent you from possibly getting hacked via the old SQL Injection routine.

http://www.unixwiz.net/techtips/sql-injection.html <--- this article explains SQL Injection in-depth.

2) Before you make that code go live, remove as much of the commenting as possible. This will speed up your code a bit.

EDIT: Please delete, mods. This is a screwup post on my part.

Comment out this Connection.execute(sSQL)

and add this

response.write sSQL

This will show you what your SQL string looks like and whether the id from your querystring is being passed. Also add this ; at the end of your SQL string, I've seen it make a difference in the past.

Thanks Everyone, I figured it out. I had the variable being passed labelled wrong on the submit page. Whoops!