SQL Injection

boywonder381

I'm having problems trying to setup SQL injection feature. I'm using 2 pages, one for the query and one for the connection. Here is my query:
<%
msg = "select P.txtAp, P.txtLevel1, P.txtPromotionGroup, P.intGroup, P.txtLevel3 , C.txtCode, ISNULL(P.curBudget, 0) as curBudget, P.ysnSurvey, "
msg = msg & " convert(date, dtmExpir 101) as dtmExpir, convert(date, dtmSubm, 101) as dtmSubm"
msg = msg & " from tblApps P inner join tblCodes C on P.txtApp = C.txtApps "
msg = msg & " where P.ynactive = 1 AND P.txtApps = ? "
%>

<%
Here is the connlogin.asp file with the connection setup:
<%
db_computer = db_computer
db_id = db_id
connstr = "Driver={SQL Server}; SERVER=" & db_computer & "; DATABASE=" & db_id &"; UID=" & db_userid & "; PWD="& db_userpw
getProgID = ProtectSQL(request.QueryString("f"))
Set oConn = server.CreateObject("ADODB.Connection")
oConn.Open connstr
oConn.Prepared = true
oConn.commandtext=msg
oConn.Parameters.Append oConn.CreateParameter("@myProgID", adInteger, adParamInput, , getProgID)
set rst = oConn.execute
%>
What I'm I doing wrong?

admin

This is a coding question about ASP. And without context or a clear description of the issue, it would be difficult to help.

boywonder381

The issue is that it does not generate an error nor does it show the data from the query by using the ?.

admin

boywonder381 wrote
The issue is that it does not generate an error nor does it show the data from the query by using the ?.

It is very hard to help with such programming errors when the program/script executes without any complaint but does not do what you want.
It is probably better to check with a friend or colleague and have a second look on the program/script. Sometimes, a fresh look can help detect errors that went unnoticed by the original developer.

boywonder381

Dont worry I fixed it...