Check with profiler that the SQL code you think is being passed to SQL Server is the code that is actually being sent to SQL Server from the asp page.

Also, think about using stored procs and parameters for these kind of affairs. Will definitely simplfy matters.