繁體中文当前位置: 首页 > 图文教程 > 网络编程 > ASP > javascript asp教程添加和修改
- ASP
- 关于网站文件自动备份程序的一点思考
- DBTree 1.3.2
- 抽取10万条数据，想起GetRows()
- 一份ASP内存的释放的实验报告
- [整理版]ASP常用内置函数
- Jmail组件发送邮件之绝对能用的函数
- 虚拟主机重启代码
- Access 开发人员常犯错误大全
- 用Asp如何实现防止网页频繁刷新？
- ASP 中使用 HTTP 协议发送参数详解
- 为什么 Windows2003 的 IIS6.0 不能上传超过 200K 的文件？
- ASP类的写法
- 实例学习如何在ASP中调用DLL
- 被动式统计网站在线人数
- [原创]完美解决ASP 不能更新。数据库或对象为只读。
- 5天学会asp
- Wrance的图片系统目录直读版1.0
- 信息发布中的判断过期和有效期的东西
- 小偷程序2
- 一个ASP中的数组
ASP 中的 javascript asp教程添加和修改
出处:互联网 整理: 软晨网（RuanChen.com） 发布: 2009-09-13 浏览: 45 ::
收藏到网摘: n/a
The Connection Execute():
If you want to retrieve data from a database then you have no choice but to use a Recordset. However, for the purposes of adding, updating, and deleting data you don't necessarily have to have a Recordset. It's up to you.
For the purposes of adding, updating and deleting you can avoid the Recordset by using the Execute() method.
Get Started:
Below is the script for Lesson 19.
<%@LANGUAGE="JavaScript"%>
var strConnect="Provider=Microsoft.Jet.OLEDB.4.0; Data Source="
strConnect += Server.MapPath("\\GOP") + "\\datastores\\gop.mdb;"
<!-- METADATA TYPE="typelib"
FILE="C:\Program Files\Common Files\System\ado\msado15.dll" -->
<HTML>
<HEAD>
<TITLE>Administrator Page - Changing the Mailing List</TITLE>
</HEAD>
<BODY LINK="red" VLINK="red" ALINK="crimson">
<H2>Administrator Page</H2>
<H3>Changing a the Mailing List</H3>
<%
if (Request.Form("Delete") > "") { var sql="DELETE FROM Address WHERE ID = " + Request.Form("ID") + ";" }
else { var firstName = new String(Request.Form("firstName")) var lastName = new String(Request.Form("lastName")) var Address = new String(Request.Form("Address")) var City = new String(Request.Form("City")) var myRegExp = /[']/g; firstName = firstName.replace(myRegExp, '''); lastName = lastName.replace(myRegExp, '''); Address = Address.replace(myRegExp, '''); City = City.replace(myRegExp, '''); var sql="UPDATE Address SET firstName= '" + firstName + "' , lastName='" sql += lastName + "' , Address='" + Address + "' , City='" sql += City + "' , State='" + Request.Form("State") + "' , Zip='" sql += Request.Form("Zip") + "' WHERE ID = " + Request.Form("ID") + ";" }
var objConn=Server.CreateObject("ADODB.Connection");
objConn.Open(strConnect)
objConn.Execute(sql)
objConn.Close()
objConn = null;
Response.Write("The member has been updated in the database.")
Response.Write("<A HREF=\"../files/committee.asp\">")
Response.Write("Click here to see it.</A>")
%>
There's no link to see this one in action. I did that for security reasons. I just want to point out a few highlights.
Danger in The Single Quote:
You'll notice that I replace single quote marks with the HTML encoded equivalent. I did that using the following code.
var myRegExp = /[']/g; firstName = firstName.replace(myRegExp, ''');
The single quote is the only character you cannot input into a database using an ASP application. Everything else is fair game. DO NOT accept any text from users into your database without replacing all single quotes. To use an analogy, the single quote is like a key that opens up your entire database. Hackers will tear your application to shreds if you let someone input single quotes.
Execute( ):
The only other thing I want to spend any time with is
评论 (0) All
