CODEWITHSUNDEEP
javascriptstringquery-string
sebastien leblanc
sebastien leblanc

Reputation: 675

Javascript string syntax to write SQL

I am writing an SQL query as a Javascript string like that:

  SQLdetail =  'SELECT [Avis SAP], Avis.[Ordre SAP], [Date Appel], [Heur Appel], Client_List![Code Client], [Numero Passerelle], [Designation Appel], Ordre![Metier], Ordre!Repercussion, Ordre!Objet, Ordre![Profil Panne], Ordre!Cause, Ordre![Sommaire Correctif], Ordre![Statut]'
  SQLdetail += ' FROM (Avis' 
  SQLdetail += ' LEFT JOIN Client_List ON Avis.[Numero Client] = Client_List.[Numero Client])' 
  SQLdetail += ' LEFT JOIN Ordre ON Avis.[Ordre SAP] = Ordre.[Ordre SAP] WHERE Avis.[Date Appel] BETWEEN #' & DateOne & '# AND #' & DateTwo & '#;' 
  alert('SQLdetail:' + SQLdetail)

and the last SQLdetail += somehow returns "0". Am I missing something in the syntax that just turns the whole string to a 0?

Upvotes: 0

Views: 1884

Answers (5)

Blender
Blender

Reputation: 298364

You are using a bitwise operator in your code:

& DateTwo &

This doesn't join strings. Use a +:

+ DateTwo +

Other than that, why in the world are you generating your SQL with JavaScript???

The only way you can send it to your server is through the browser, which means that I have total control over the request.

Basically, you are giving me root privileges to your database. I'm nice and won't abuse it, but I can only speak for myself.

Upvotes: 2

Abdul Munim
Abdul Munim

Reputation: 19217

You're mixing with VB syntax. In JavaScript you must concatenate string with +

SQLdetail += ' LEFT JOIN Ordre ON Avis.[Ordre SAP] = Ordre.[Ordre SAP] WHERE Avis.[Date Appel] BETWEEN #' + DateOne + '# AND #' + DateTwo + '#;'

Upvotes: 2

mike jones
mike jones

Reputation: 659

If this is Javascript you need to use + instead of & here:

SQLdetail += ' LEFT JOIN Ordre ON Avis.[Ordre SAP] = Ordre.[Ordre SAP] WHERE Avis.[Date Appel] BETWEEN #' & DateOne & '# AND #' & DateTwo & '#;'

Upvotes: 2

Naftali
Naftali

Reputation: 146310

What are with the &? : BETWEEN #' & DateOne & '# AND #' & DateTwo & '#;'

Change to a +

Upvotes: 2

David Laberge
David Laberge

Reputation: 16061

You are using & to concatenate instead of +

Upvotes: 1

Related Questions