CODEWITHSUNDEEP
sql
Or Cyngiser
Or Cyngiser

Reputation: 1065

Can someone clarify this SQL command

I saw this in some ASP code and didnt understand the last line, specifically all the apostrophies and quotation marks between Name= and AND. what is being appended? why do we need both? 

uName = getRequestString("UserName");
uPass = getRequestString("UserPass");

sql = "SELECT * FROM Users WHERE Name ='" + uName + "' AND Pass ='" + uPass + "'"

Upvotes: 0

Views: 6715

Answers (5)

Benjamin RD
Benjamin RD

Reputation: 12034

That is very simple, you have the start of a string sentence with double quotes. Double quotes indicate the start and the end or part of a string.

for example, if you have

sql ="SELECT * FROM USERS"

your sentence takes all the value; if you have:

sql = "SELCT * FROM USERS"
whereSentence = " WHERE id = 1"
wholeSql = sql + whereSentence

with the + (plus symbol) you are concatening all the string. With the simple quotes you are adding the simple quote in the string and concatening the other parts of the sentence.

For example if

uName = 'John' and uPass = 'McDonals'

sql = "SELECT * FROM Users WHERE Name ='" + uName + "' AND Pass ='" + uPass + "'"

your final sentence should be

SELECT * FROM Users WHERE Name = 'John' And Pass = 'McDonals'.

Is a simple way to say that the name is John McDonals as String, but the parameters are variables, depending the request

Upvotes: 1

Kitet
Kitet

Reputation: 883

If you wrote:

SELECT x from y where y.name = martin

you would get an error. You need apostrophes to denote a string, like so:

SELECT x from y where y.name = 'martin'

Quotes are because someone appends a variable to a string, then appends another string and first character of that string, the apostrophe, is a closing apostrophe after my martin example.

Don't do that though, I mean don't append variables to strings, unless you know what you are doing. Use parameterized queries.

Upvotes: 0

Kevin
Kevin

Reputation: 2182

This code is building a complete string for the SQL request. Presumably, this is connected to a webpage that asks for the username and password to be submitted in a block.

The uName and uPass strings will be set to something like this:

uName = "John";
uPass = "qwerty";

When the sql string gets created, the SQL query needs to put quotes around the string values, so the final query will look like this:

sql = "SELECT * FROM Users WHERE Name ='John' AND Pass ='qwerty'"

Upvotes: 0

Ryan
Ryan

Reputation: 28187

The code is building a query that looks like this:

SELECT * FROM Users WHERE Name = 'foo' AND Pass = 'bar'

It passes in the text from the uName and uPass variables into the query string.

This is very dangerous though - it's an open door for SQL Injection.

Upvotes: 2

markusthoemmes
markusthoemmes

Reputation: 3120

The first quotation (') mark is in the SQL lateron. The second quotation mark ("), marks the String literal for ASP.

After parsing, the query will be something like:

SELECT * FROM Users WHERE Name ='name' AND Pass ='password'

Which is why you need the ', because your intention is to give the DBMS a string.

Upvotes: 0

Related Questions