First ! Fogiver me about my English. I'm a Vietnamese

I'm creating a feedback page I use Ms Access Database
when a customer feedback my page then it will be insert into
my database . When i want to read the content of the customer feedback
i must be login into my page. But i dont know how to i reject
SQL injection in my page

i think you have to clear more

Ahmed Ali
Software Developer

Hello,

You need to check user input, some of the following characters below would be involved:

--, *, "UNION SELECT"

There are some other characters to test, if you look it up in the web.

Brian

<%
    response.buffer = true

' ==request UserName and Password here==
    uid = request("UserName")
    pwd = request("Password")

' ==start sanitizing uid and pwd==
    ThisUid = true
    ThisPwd = true
    sChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890abcdefghijklm nopqrstuvwxyz"

    LenPwd = Len(Uid)
    for n = 1 to LenUid
        MidUid = Mid(Uid,n,1)
        if InStr(sChars, MidUid) = 0 then
            ThisUid = false
        end if
    next

    LenPwd = Len(Pwd)
    for p = 1 to LenPwd
        MidPwd = mid(Pwd,p,1)
        if InStr(sChars, MidPwd) = 0 then
            ThisPwd = false
        end if
    next

' ==bounce back to login page if Uid or Pwd is invalid otherwise continue authentication==
    if ThisUid = false OR ThisPwd = false then

        response.redirect "LoginPage.asp"

    else

' --authenticate against database here--

    end if
%>