SQL Injection

[boywonder381]

I'm having problems trying to setup SQL injection feature. I'm using 2 pages, one for the query and one for the connection. Here is my query:

<%
msg = "select P.txtAp, P.txtLevel1, P.txtPromotionGroup, P.intGroup, P.txtLevel3 , C.txtCode, ISNULL(P.curBudget, 0) as curBudget, P.ysnSurvey, "
msg = msg & " convert(date, dtmExpir 101) as dtmExpir, convert(date, dtmSubm, 101) as dtmSubm"
msg = msg & " from tblApps P inner join tblCodes C on P.txtApp = C.txtApps "
msg = msg & " where P.ynactive = 1 AND P.txtApps = ? "

%>
<!--#include file="vb/connlogin.asp"-->

<%

Here is the connlogin.asp file with the connection setup:

<%

db_computer = db_computer
db_id = db_id

connstr = "Driver={SQL Server}; SERVER=" & db_computer & "; DATABASE=" & db_id &"; UID=" & db_userid & "; PWD="& db_userpw

getProgID = ProtectSQL(request.QueryString("f"))
Set oConn = server.CreateObject("ADODB.Connection")
oConn.Open connstr
oConn.Prepared = true
oConn.commandtext=msg
oConn.Parameters.Append oConn.CreateParameter("@myProgID", adInteger, adParamInput, , getProgID)

set rst = oConn.execute

%>

What I'm I doing wrong?
_________________
boywonderrrr

[admin]

This is a coding question about ASP. And without context or a clear description of the issue, it would be difficult to help.
_________________
Follow @abyssws on Twitter
Subscribe to our newsletter
_________________
Forum Administrator
Aprelium - https://aprelium.com

[boywonder381]

The issue is that it does not generate an error nor does it show the data from the query by using the ?.
_________________
boywonderrrr

[admin]

[boywonder381]

Dont worry I fixed it...
_________________
boywonderrrr