[justin.g]

This is the error I am getting. Can somebody please help me out. Its probably something stupid I did wrong.

Syntax error (missing operator) in query expression 'MESSAGES.CAT_ID ='.
/forum/CAForum/admin/inc_forums.asp, line 38

here is the asp code:

<%
connSTR = "DRIVER={Microsoft Access Driver (*.mdb)};DBQ=" & Server.MapPath("CAForum.mdb") 
%>
 
 
<table width="100%" cellspacing="0" cellpadding="1" align="center" border="1" ID="Table1">
 
 
<tr>
<td>
<a href="post.asp">>>Post new message</a>
</td> </tr></table> 
 
 
<%
Dim intPage,intCat_Id
intPage = Request.QueryString("page")
intCat_Id=Request.QueryString("iCat_id")
 
If intPage <> "" Then
   If IsNumeric(intPage) Then
      If intPage < 1 Then
         intPage = 1
      End If
   Else
      intPage = 1
   End If
Else
   intPage = 1
End If
 
set rsForums = Server.CreateObject("ADODB.Recordset")
rsForums.ActiveConnection = connSTR
rsForums.Source = " SELECT * FROM (SELECT *, (SELECT COUNT (*) FROM REPLIES WHERE REPLIES.MSG_ID = MESSAGES.MSG_ID) AS REP_COUNT FROM MESSAGES, CATEGORIES WHERE CATEGORIES.CAT_ID = MESSAGES.CAT_ID) WHERE MESSAGES.CAT_ID = " & intCat_Id & " ORDER BY MSG_LAST_POST DESC"
rsForums.CursorType = 3
rsForums.CursorLocation = 2
rsForums.LockType = 3
rsForums.CacheSize = 10
rsForums.PageSize = 10
 
rsForums.Open() %>
 
 
 
 
 
 
<table width="100%" cellspacing="0" cellpadding="1" align="center" border="1">
<TR class="Header"> 
          <TD  width=70% height="16" align="left" valign="middle">TOPIC</TD>
          <TD width=10% height="16" align="center" valign="middle">POSTED</TD>
          <TD width=10% height="16" align="center" valign="middle">REPLIES</TD>
          <TD width=10% height="16" align="right" valign="middle">LAST POST</TD>
</TR>
 
 
 
   
<%
 
If Not rsForums.EOF Then
     If CInt(intPage) > CInt(rsForums.PageCount) Then
          intPage = Int(rsForums.PageCount)
     End If
 
     rsForums.AbsolutePage = CInt(intPage)
     for i=1 to rsForums.PageSize 
     if not rsForums.EOF then
%>
 
 
<TR> 
          <TD height="16" align="left" valign="middle"> 
            <a href="messages.asp?iMsg_id=<%=(rsForums.Fields.Item("MSG_ID").Value)%>&iCat_id=<%=(rsForums.Fields.Item("CAT_ID").Value)%>"><%=(rsForums.Fields.Item("MSG_SUBJECT").Value)%></a></TD>
          <TD height="16" align="left" valign="middle"><%=(rsForums.Fields.Item("DATE_POSTED").Value)%></TD>
          <TD height="16" align="center" valign="middle"><%=(rsForums.Fields.Item("REP_COUNT").Value)%></TD>
          <TD height="16" align="right" valign="middle"><%=(rsForums.Fields.Item("MSG_LAST_POST").Value)%></TD>
</TR>
 
<% 
 rsForums.MoveNext
     end if
     next 
 
     Dim strPage
     strPage = Request.ServerVariables("SCRIPT_NAME")
 
 
          %>
          <tr>
          <td colspan="9">
           <%
          For i = 1 To rsForums.PageCount
          if cint(i)=1 then
          Response.Write("Page: ")
          end if
          If cint(i) <> cint(intPage) Then  
          Response.Write("<a href=""" & strPage & _
               "?page=" & i & "&iCat_id=" & intCat_Id & """>" & i & "</a> ")
          Else
          Response.Write("[" & i & "] ")
          End if
     Next%>
     
         </td> 
          </tr>
<%Else%>
 
 
  <tr>
          <td colspan="9">
      There is no records in database !!! 
      </td> 
          </tr>
     <%
End If
 
rsForums.Close
SET rsForums=NOTHING
 
%>
 
</table>
 
 
<tr> 
   
         <td  colspan="4" align=right>
         Powered by
         <a href="#"><img src="CAForum/images/calogo.gif" border=0 ></a>
         </td>
         </tr>
</table> 

------------------------------------------------------------------------------------------------------------------------
please help me out.

[urstop]

Could be the intCat_Id variable is not getting populated correctly. Please print out the SQL statement on to the browser and see if it is well formed. You can run it directly on Access database to make sure there are no errors in your SQL.

[Dwagar]

Your code can be attacked using a SQL Injection.

I would change this code

rsForums.Source = " SELECT * FROM (SELECT *, (SELECT COUNT (*) FROM REPLIES WHERE REPLIES.MSG_ID = MESSAGES.MSG_ID) AS REP_COUNT FROM MESSAGES, CATEGORIES WHERE CATEGORIES.CAT_ID = MESSAGES.CAT_ID) WHERE MESSAGES.CAT_ID = '" & fixword(intCat_Id) & "' ORDER BY MSG_LAST_POST DESC"

Then add a function

function fixword(stext)
fixword = replace(stext,"'","''")
end function

Maybeyour querystring is passing a ' and that can cause an error too.