CODEWITHSUNDEEP
vbscript
Ali Sheikhpour
Ali Sheikhpour

Reputation: 11055

I can not create a simple vbscript string

I faced this problem many times and I'm looking for the causing reason.

sql="update setting set hashcode='"&hashcode&"'"

Error:

sql="update setting set hashcode='"&hashcode&"'"

----------------------------------------------^

Microsoft VBScript compilation error '800a0401'

Expected end of statement

Please note that Changing the initial value of hashcode is not effective.

But this works fine

sql="update setting set anotherword='"&anotherword&"'"

Do you have any idea why renaming the parameter solves the problem?

Upvotes: 0

Views: 66

Answers (1)

Keith Hall
Keith Hall

Reputation: 16065

You need whitespace surrounding the & character to prevent ambiguity.

&ha is seen as a numeric (hexadecimal) value, and it is illegal to directly follow a string, which is why an end of statement is expected. (&h denotes the start of a hexadecimal number in vbscript, and a is a valid hex digit.)

So your code should be:

sql = "update setting set hashcode = '" & hashcode & "'"

Side note: to prevent SQL injection (depending where the value inside your hashcode variable came from), you may want to use replace(hashcode, "'", "''")

Upvotes: 7

Related Questions