asp与SQL的问题

1@ Language = "VBScript" 

 1   
 2strTitle = Request.Form("title")   
 3strTitle = Trim(strTitle)   
 4strTitle = replace(strTitle,"'","''")   
 5  
 6strTitle = server.HTMLEncode(strTitle)   
 7'strTitle = replace(strTitle,"<","<")   
 8'strTitle = replace(strTitle,">",">")   
 9  
10strflag_attention = Request.Form("flag_attention")   
11if strflag_attention = "on" then   
12flag_attention = 1   
13else   
14flag_attention = 0   
15end if   
16  
17strText = Request.Form("detail")   
18strText = replace(strText,"'","''")   
19  
20'strText = server.HTMLEncode(strText)   
21'strText = replace(strText,chr(13)&chr(10),"
22")   
23'strText = replace(strText," "," ")   
24  
25strText = replace(strText,"<","<")   
26strText = replace(strText,">",">")   
27  
28dim objCnn,rs   
29strDSN = "dsn=newdata;uid=;pwd=;"   
30strSQL = "SELECT MAX(idnum) from board"   
31cod_AdoOpen objCnn,rs,strDSN,strSQL   
32  
33if isnull(rs(0)) then   
34idnum=1   
35else   
36idnum=rs(0)+1   
37end if   
38rs.close   
39  
40strSQL = "insert into board(IDNUM,title,flag_attention,detail) values (" &idnum &",'" &strTitle & "'," & flag_attention & ",'" & strText & "')"   
41'Response.Write strSql   
42objCnn.Execute(strSQL) 提示是这一句的问题！   
43  
44objCnn.close   
45set objCnn = nothing   
46  
47response.redirect "bulletin.asp"