Coldfusion Query / SQL Syntax Problem.

[bennimartin]

Hey,
I'm getting an error when i try and information to my access databse from my form. I'm knew to Coldfusion and SQL but i have searched high and low for the cause of my syntax error but no matter what i try i cant get it to work, so any help would be greatly appreciated.

Here is the code:

<cfquery name="qInsert" datasource="A13060_13398620">

INSERT INTO Listings

(Price, Address, Status_ID, Suburb_ID, Bathrooms, Bedrooms, Comments,
Pool, Fireplace, Garage, Laundry, )

VALUES

(#form.Price#, '#form.Address#', #form.Status_ID#, #form.Suburb_ID#,
#form.Bathrooms#, #form.Bedrooms#, '#form.Comments#',

<cfif isDefined("form.Pool") >
         'Yes'
<cfelse>
          'No'
</cfif>,

<cfif isDefined("form.Fireplace") >
         'Yes'
<cfelse>
          'No'
</cfif>,

<cfif isDefined("form.Garage") >
         'Yes'
<cfelse>
          'No'
</cfif>,

<cfif isDefined("form.Laundry") >
         'Yes'
<cfelse>
          'No'
</cfif> )


</cfquery>

Basically the last four were checkboxes and i just want it to insert yes or no into the related record.

Here are the datatypes in access:
Price = Currency
Address = Memo
Status_ID = Number
Suburb_ID = Number
Bathrooms = Number
Bedrooms = Number
Comments = Memo
Pool = Text
Fireplace = Text
Garage = Text
Laundry = text

And here is the error

[Macromedia][SequeLink JDBC Driver][ODBC Socket][Microsoft][ODBC Microsoft Access Driver] Syntax error in INSERT INTO statement.


Once again thanks

Ben

[GoldCoast_Nerd]

<cfquery name="qInsert" datasource="A13060_13398620">

INSERT INTO Listings

(Price, Address, Status_ID, Suburb_ID, Bathrooms, Bedrooms, Comments,
Pool, Fireplace, Garage, Laundry )

VALUES

(#form.Price#, '#form.Address#', #form.Status_ID#, #form.Suburb_ID#,
#form.Bathrooms#, #form.Bedrooms#, '#form.Comments#',

<cfif isDefined("form.Pool") >
'Yes'
<cfelse>
'No'
</cfif>,

<cfif isDefined("form.Fireplace") >
'Yes'
<cfelse>
'No'
</cfif>,

<cfif isDefined("form.Garage") >
'Yes'
<cfelse>
'No'
</cfif>,

<cfif isDefined("form.Laundry") >
'Yes'
<cfelse>
'No'
</cfif> )


</cfquery>


That should work , but i won't recommend using cfif in the query statements, u would much rather cfset them before the query, but its ur call

[FSUKXAZ]

You left a an extra comma in the insert statement.

Also, the query is too vunerable to hacking. Whenever using inline SQL you MUST use CFQUERYPARAM. An example on one of yours would be:
<CFQUERYPARAM CFSQLTYPE="CF_SQL_INTEGER" MAXLENGTH="8" VALUE="#form.Price#">,