where to put .asp code into html code

This thread is about Classic ASP + an Access back end, so the simplest and most reliable approach is: keep the form in an HTML section (or a .asp page) and post it to a .asp processing page that runs the server-side code. This keeps markup and server logic clear and avoids trying to "embed" runtime ASP into a static .html file.

A minimal form (form.asp) posts to a processor (save.asp):

<form method="post" action="save.asp">
  <input type="text" name="username">
  <input type="email" name="email">
  <input type="submit" value="Submit">
</form>

Processor example (save.asp) — Classic ASP + ADO with parameterized insert:

<%
Dim conn, cmd, dbPath
dbPath = Server.MapPath("db/mydb.mdb")

Set conn = Server.CreateObject("ADODB.Connection")
conn.Open "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & dbPath & ";"

Set cmd = Server.CreateObject("ADODB.Command")
cmd.ActiveConnection = conn
cmd.CommandText = "INSERT INTO Users (username,email) VALUES (?,?)"
cmd.Prepared = True
cmd.Parameters.Append cmd.CreateParameter("p1", 200, 1, 50, Request.Form("username"))
cmd.Parameters.Append cmd.CreateParameter("p2", 200, 1, 100, Request.Form("email"))
cmd.Execute

conn.Close
Set cmd = Nothing
Set conn = Nothing
Response.Redirect "thanks.asp"
%>

Practical notes and troubleshooting

• Use Server.MapPath so the connection string points to the correct file path.
• Grant the IIS process user write permissions on the folder with the .mdb (do not place the .mdb in a publicly browsable folder).
• For .accdb use the ACE provider (Microsoft.ACE.OLEDB.12.0) and watch 32/64-bit provider issues — JET is 32-bit only, so you may need to enable 32-bit mode on the app pool or install the proper ACE engine.
• Always use parameterized commands (shown) to avoid injection.
• Access is fine for low-traffic testing; for concurrent users or payment flows consider moving to a server RDBMS and use HTTPS and proper payment gateway APIs.

This addresses @ultimate_fusion’s question about where to put the ASP code and expands on platform choices mentioned by @hollystyles and payment/email concerns raised by @daastan with concrete Classic ASP steps and deployment cautions.