142759 - ASP informations posting error

Status: RESOLVED INVALID

(Core :: Layout: Form Controls, defect)

Description

[martin sylvain]

attemps to write to the SQL database on this website fail with RC1 while it
worked with 0.9.3 and 0.9.9 (my current build ID is 2002041711).
result page shows:

Microsoft Active Server Pages error '80040e14'

[Microsoft][ODBC SQL Server Driver][SQL Server]Line 2: Incorrect syntax near
')'. INSERT comments (idsong,comment,idnick) VALUES(53374,'posting problems :( ',)
--^  obviously missing user indentification here :(
/nec_valide.asp, line 276

---end of result page---

unfortunately, you'll need an account on that website to reproduce the bug ...

Comment 1

[rods (gone)]

-->

Comment 2

[Boris Zbarsky [:bzbarsky]]

martin, could you save the web page you submit from as "web page, complete", zip
up the files, and attach them to this bug?

Comment 3

[martin sylvain]

Attachment: A copy of the whole page (+images, etc.) where the problem occurs ...

problem occurs with the "post comment" feature, with 'add favourite' button,
and the 'request' button

Comment 4

[alge]

Works for me. 
I put a testcasethingie on http://alge.nlc.no/~alge/nectarine/info.html .. try
to add a comment. Should yield post variables:
_POST["u"]       nec:comment  
_POST["idsong"]  53381  
_POST["idnick"]  1727  
_POST["comment"] ...f  
_POST["Submit"]  Add your comment 

..and try newer build.

Comment 5

[Alexander Opitz]

reporter:

Can you try a newer build an tell if this bug exists?
On the other side ... it seems that the ASP doesn't handle strings correctly ...
there may be a security hole in it.

Comment 6

[Alexander Opitz]

No response since over 1 month.

closing as invalid.