> >> I have a strange problem. ASP pages that have worked for years are
> >> suddenly giving me errors. Here's the scenario.
[quoted text clipped - 27 lines]
>
> - Show quoted text -
> Here goes.
Err ... not exactly what I asked for (I cannot run this code to try to
reproduce your symptoms without taking time to rewrite it), but I will
make some comments about it:
> strsql = "SELECT ctridx, txtuser, txtpwd, lngclient, txtFirst, txtLast
> " & _
> "FROM dbo.tblPODescUpdaters WHERE (txtuser ='" &
> Request.Form("login") & "')"
<gasp> I will have a very important comment to make about this at the
end of this post.
> rst.open strsql, con, adOpenKeyset, adLockReadOnly
Why are you using a keyset for this? Major overkill. All you need is a
default forward-only cursor:
set rst=con.execute(strsql,,1)
> if not rst.EOF Then
>
[quoted text clipped - 15 lines]
>
> rst.Close
<snip - no need to see all this html>
> <%' Get a list of authorized field destinations
> strsql = "SELECT TOP 100 PERCENT
[quoted text clipped - 7 lines]
> session("useridx") & ") ORDER BY dbo.TblFieldDest.TxtDestName"
> rst.open strsql, con, adOpenKeyset, adLockReadOnly
Again, I see no need for a keyset cursor. See if changing to the default
cursor solves your problem.
If you haven't shown us everything an you feel you really need a keyset
cursor for some reason (almost never the case in ASP - keysets are
desirable when you are planning to keep a cursor open for long periods
of time, much longer than would be the case in an ASP page), then you
should try re-instatiating the recordset between opens.
****VERY IMPORTANT!!******************
Further points to consider:
Your use of dynamic sql is leaving you vulnerable to hackers using sql
injection:
http://mvp.unixwiz.net/techtips/sql-injection.html
http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23
See here for a better, more secure way to execute your queries by using
parameter markers (tokens):
http://groups-beta.google.com/group/microsoft.public.inetserver.asp.db/msg/72e36
562fee7804e
Personally, I prefer using stored procedures, or saved parameter queries
as they are known in Access:
Access:
http://www.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=e6lLVvOcDHA.1204%4
0TK2MSFTNGP12.phx.gbl
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&c2coff=1&selm=eHYxOyvaDHA.402
0%40tk2msftngp13.phx.gbl
SQL Server:
http://groups.google.com/group/microsoft.public.inetserver.asp.general/msg/5d3c9
d4409dc1701?hl=en

Signature
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.
Dannasoft - 15 May 2008 16:48 GMT
On May 15, 10:14 am, "Bob Barrows [MVP]" <reb01...@NOyahoo.SPAMcom>
wrote:
> > Here goes.
>
[quoted text clipped - 83 lines]
>
> - Show quoted text -
Thanks for your help, dropping the keyset curser resolved the open
recordset issue and I'll review that throughout.
I'll also read your links on SQL injection. One question before I
get into it, am I vulnerable even running the web app under SSL?
Bob Barrows [MVP] - 15 May 2008 16:57 GMT
> I'll also read your links on SQL injection. One question before I
> get into it, am I vulnerable even running the web app under SSL?
Absolutely. Read the links.

Signature
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.