View Single Post
Old 11-05-2012, 07:47 PM   PM User | #2
Old Pedant
Supreme Master coder!

 
Old Pedant's Avatar
 
Join Date: Feb 2009
Posts: 23,168
Thanks: 59
Thanked 3,992 Times in 3,961 Posts
Old Pedant is a name known to allOld Pedant is a name known to allOld Pedant is a name known to allOld Pedant is a name known to allOld Pedant is a name known to allOld Pedant is a name known to all
Ummmm...
Code:
Function ChkString(string) 
    If string = "" Then string = " " 
    ChkString = Replace(string, "'", "'") 
End Function
The line in red is totally bogus. Kill it before it multiplies. The *LAST* thing you want to do is convert "" to a space!

As for the rest...

Code:
strQuery = "select name, status, objid from object where (objid like '" & Request.QueryString("objid") & "%') "
Where, pray tell, in your <form> to you see a field named objid???

The only field you show is this one:
Code:
<input name="toggle_maint" type="checkbox" value="<% = objid %>">
Secondly, given that toggle_maint contains exactly and precisely the value objid why would you then use LIKE in your query?

Thirdly, if the objid field in the DB is a NUMBER, then you should never put apostrophes around the value in the query.

Fourthly, what do you do if the user checks 2 or 3 or 4 of those checkboxes?
__________________
An optimist sees the glass as half full.
A pessimist sees the glass as half empty.
A realist drinks it no matter how much there is.
Old Pedant is offline   Reply With Quote