Search data between 3 conditions

Asked May 25 '16 at 07:35

Active May 25 '16 at 10:29

Viewed 48 times

I used to search in the database SQL.

HTML:

<form name="frmReport" method="get" action="">
<input id="txtKeyword" class="textbox" type="text" size="1" name="Keyword" value="<%=Keyword%>">
<input type="text" name="SDate" style="width:100; height:19" size="20" id="datepicker" class="textbox">
<input type="text" name="EDate" style="width:100; height:19" size="20" id="datepickerExp" class="textbox">
<input type="submit" value="viewReport" name="btnSearch" style="font-family: Arial, Tahoma; font-size: 9pt; border-style: outset; border-width: 2px;height:20;width:90">
</form>

ASP:

Dim Keyword, StartDate, EndDate
keyword   = request.Querystring("keyword")
StartDate = request.Querystring(StartDate")
EndDate   = request.Querystring("EndDate")
strSQL = "SELECT * FROM Report WHERE UserID LIKE '%" & Keyword & _
         "' and DatePO BETWEEN #" & startDate & "# AND #" & endDate & "#"
RS.Open strSQL, Conn, 3, 1
Conn.Execute(strSQL)

I am encountering errors (line 40 is the SQL statement).

Microsoft JET Database Engine error '80040e07'

Syntax error in date in query expression 'UserID LIKE '%' and DatePO BETWEEN ## >= ## AND ## <=##'. /ViewReport.asp, line 40

edited May 25 '16 at 10:29

Ansgar Wiechers

193,178
25
254
328

asked May 25 '16 at 07:35

Đức Hải - internet8x

1

Use parameterized queries instead of string cconcatenation, that will most likely also fix this issue apart from other things like sql-injection that you currently "support". – Tim Schmelter May 25 '16 at 07:42
Can you help me sql statements are not? – Đức Hải - internet8x May 25 '16 at 07:56
2

Typo line 3 should be `StartDate=Request.Querystring("StartDate")` *(missing starting quote in StartDate)*. – user692942 May 25 '16 at 09:12
[Reference](https://support.microsoft.com/en-us/kb/200190). – Ansgar Wiechers May 25 '16 at 10:34

Search data between 3 conditions

0 Answers0