ASP and SQL quotes dilemma

[acc]

I have a brain teaser of a situation (at least for me).
Can you see the error here? I certainly can't...been looking at it for hours.

set rsResult=conntemp.Execute("UPDATE user_data SET hz_score = " & Request.querystring("hz_score"),"hz_status ='" & Request.querystring ("hz_status") & "' WHERE user_name='" & Request.querystring("user_name") & "' AND user_id = '"& Request.querystring("user_id") & "'")

When I put the following in the IE Location Bar to test, I don't get an error, but the db doesn't update the hz_status field.
.../result_rec.asp?user_name=alan&user_id=6&hz_score=35&hz_status=commander

I know it's something I need to do re: quote placement for the second SET statement and the separating comma... just don't see it.

Thanks if you have any insight.
alan

[chrismartz]

UPDATE user_data SET hz_score = " & Request.querystring("hz_score"),"hz_status ='" & Request.querystring ("hz_status") & "' WHERE user_name='" & Request.querystring("user_name") & "' AND user_id = '"& Request.querystring("user_id") & "'")
You need to do this with your hz_score
hz_score = " & Request.querystring("hz_score") & "

[Terrorke]

I would also use single quotes arround it.

hz_score = '" & request.querystring("hz_Score")&"' , hz_status= ...

[acc]

Chrismartz & Terrorke:
Thank you! That worked! Cool.
Wondering how the single quotes works even though the data type in Access is Number??

Well, I'm off to the next hurdle...
Appreciate your time.
acc

[Terrorke]

With a numeric datatype you don't have to use the sigle quotes.
In that you are correct

Grtz

[Ubik]

By The Way:

Using request variables directly into your SQL is never ever a good idea.

Always assign the request variable to antoher, controllable type, then check them to ensure they are valid, then put them into your SQL.

Using your SQL above, I could go to that page and do something like this:

http://yoursite.com/yourpage.asp?hz_Score=<%=server.URLencode("' & (SELECT username, password FROM USERS) & 'foo")%>

[acc]

Is that what the Validate Input 'Sticky' at the top of the ASP forum is about?
Thanks for the heads up...
acc

[russell]

exactly