Syntax error in Update Statement ASP Classic - sql

Question

I am having the syntax error in my code on a update statement, after reading multiple posts about it I cant figure out what is causing the error.
The code is as follows:
if request.querystring("do")="customer" then
New_customer = request.Form("customer")
openconn con
sSQL="SELECT RelationNumber FROM Relations WHERE RelationName='" & New_customer & "'"
set rst = con.execute(sSQL)
if rst.EOF then
response.write "No relation found"
else
Relationnumber_update = rst("RelationNumber")
sSQL2="SELECT Number FROM Orders WHERE Relation=" & Relationnumber_update & ""
set rst2 = con.execute(sSQL2)
if rst2.EOF then
response.write("No order number found!")
else
if Relationnumber_update <> 1000 then
Ordernumber_update = rst2("Nummer")
sSQL3="UPDATE Bookings SET Order=" & Ordernumber_update & " WHERE ID=" & request("ID")
con.execute(sSQL3)
else
response.write("Order number 1000 is not allowed!")
end if
end if
end if
closeconn con
response.redirect("myPage.asp?action=page")
response.end
end if
The error happens on the line: sSQL3="UPDATE Bookings SET Order=" & Ordernumber_update & " WHERE ID=" & request("ID")
Things to know:
The request queriestring is from the form where the user can choose a customer in a dropdown list. See code: <form name="ChangeCustomer" method="post" action="myPage.asp?action=page&do=customer&ID=<%=rst("ID")%>" style="display:inline">
The rst from ID is from a select statement before which works since I used in also in other code in the same way (that does work).
The openconn con is a function for accessing my database (it works, same reason as above)
Eacht select statement in this code has been tested for its output in a response.write. All the results that came out were the expected ones.
Short description of what happens in the code above
A user changes the customer in the form (with a dropdown menu) and presses save (submit).
On submit the queriestring is launched, this was tested if the code actually comes to this and it does.
The chosen customer is saved in the var New_customer.
The relation number that matches the customer name is retrieved with the first select statement.
The right relation number is being put into the var Relationnumber_update
In the second query the right number is being searched for that equals the relation number.
A if/then follows which makes sure the Relationnumber_update is not equal to 1000 (no updates should be done on this number)
If its not equal to 1000 then the found order number (second select statement) is stored in the var ordernumber_update
The update statement follows where Order field in the bookings table is being updated with the found ordernumber.
In the end (after the if) the connection is being closed and the page is being 'refreshed'.
For some reasson I am getting the syntax error on my update statement but I have no clue why. I checked the data types of the Number field in the orders table, the Relationnumber from the Relations table and the Order field in the bookings table, they are all of type number/int.
I also tried to update with a set number directly in the update statement instead of the ordernumber_update var (like so: sSQL3="UPDATE Bookings SET Order=6477 WHERE ID=" & request("ID")) but this gives the same error..

Answer 1

Three things:
Read about Sql Injections
To debug sql statement "live", use
sSQL3="UPDATE Bookings ...
Response.Write(sSQL3)
'con.execute(sSQL3) -- comment it out
run page, and test resulted sql query against database
If ID has string datatype (char, varchar, etc) then you should quote its value using '...'
P.S.
Use [Order] to deal with reserved words.

Answer 2

Be aware of the reserve words of database management system.
Here you are using Order, which is a reserved one.
So use this if you using MySQL:
sSQL3="UPDATE Bookings SET `Order`=" & Ordernumber_update & " WHERE ID=" & request("ID") &";"
Or in case of SQL Server:
sSQL3="UPDATE Bookings SET [Order]=" & Ordernumber_update & " WHERE ID=" & request("ID") &";"
Hope this will help others also. Thank you.

Answer 3

Use bracketes aound [Order], not single quotes. And don't use reserved words for your field names. Jus sayin'.