Check Code

[dntel]

I'm wondering if someone will skim over this and see if there is any errors in it, im new to SQL: im trying to put this code as an asp file to linked to a javascript, so i can do an action asynchronously (sorry if i dont explain myself very well)

This is the code:

<%
response.expires=-1
sql="SELECT * FROM CURRENCY CODES WHERE CURRENCY NAME="
sql=sql & "'" & request.querystring("q") & "'"

set conn=Server.CreateObject("ADODB.Connection")
conn.Provider="Microsoft.Jet.OLEDB.4.0"
conn.Open(Server.Mappath("/trade/Currency_codes.mdb"))
set rs = Server.CreateObject("ADODB.recordset")
rs.Open sql, conn

response.write("<div>")
do until rs.EOF
for each x in rs.Fields
response.write("<div<b>" & x.name & "</b></div")
next
rs.MoveNext
loop

response.write("</div>")
%>



I have a an ACCESS database that im trying to extract a field into a <div>

thanks in advance:D

[mattyblah]

you're leaving yourself open to sql injection. also, it's usually frowned upon to use select * unless you have a good reason.

[dntel]

Thanks, although im not worried about anyone doing anything malicious, its just a small project im doing for my internship, so its just running on IIS local server, if i can get it working, just wanted to see if there was anything completely wrong with it.