繁體中文当前位置: 首页 > 图文教程 > 网络编程 > ASP > javascript asp教程添加和修改
- ASP
- asp下检查表中是否存在某个字段（列）函数
- ASP批量更新代码
- asp飞飞无限级分类v1.0 Asp+sql+存储过程+ajax提供下载
- 比较详细的ASP rs.open语句详细说明
- 可以应用到马克斯电影站生成Rss Feed的代码
- ASP 无限级分类实现
- 从数据库中读取记录横向排列
- ASP动态级联菜单实现代码
- 网上用的比较多的asp级联菜单效果代码
- ASP提高数据显示效率-缓存探幽
- asp经常被忽视的一种死循环
- 关于Asp代码与页面的分离模板技术
- 用GetString提高ASP的速度
- 用cookies实现闪电登录论坛方法
- 一个不太让人讨厌的自动弹出窗口
- asp格式化日期时间格式的代码
- ASP变量加变量实现代码
- asp向数据库插入数据的方法rs
- asp上传带显示的代码
- asp防止垃圾留言代码
ASP 中的 javascript asp教程添加和修改
出处:互联网 整理: 软晨网（RuanChen.com） 发布: 2009-09-13 浏览: 113 ::
收藏到网摘: n/a
The Connection Execute():
If you want to retrieve data from a database then you have no choice but to use a Recordset. However, for the purposes of adding, updating, and deleting data you don't necessarily have to have a Recordset. It's up to you.
For the purposes of adding, updating and deleting you can avoid the Recordset by using the Execute() method.
Get Started:
Below is the script for Lesson 19.
<%@LANGUAGE="JavaScript"%>
var strConnect="Provider=Microsoft.Jet.OLEDB.4.0; Data Source="
strConnect += Server.MapPath("\\GOP") + "\\datastores\\gop.mdb;"
<!-- METADATA TYPE="typelib"
FILE="C:\Program Files\Common Files\System\ado\msado15.dll" -->
<HTML>
<HEAD>
<TITLE>Administrator Page - Changing the Mailing List</TITLE>
</HEAD>
<BODY LINK="red" VLINK="red" ALINK="crimson">
<H2>Administrator Page</H2>
<H3>Changing a the Mailing List</H3>
<%
if (Request.Form("Delete") > "") { var sql="DELETE FROM Address WHERE ID = " + Request.Form("ID") + ";" }
else { var firstName = new String(Request.Form("firstName")) var lastName = new String(Request.Form("lastName")) var Address = new String(Request.Form("Address")) var City = new String(Request.Form("City")) var myRegExp = /[']/g; firstName = firstName.replace(myRegExp, '''); lastName = lastName.replace(myRegExp, '''); Address = Address.replace(myRegExp, '''); City = City.replace(myRegExp, '''); var sql="UPDATE Address SET firstName= '" + firstName + "' , lastName='" sql += lastName + "' , Address='" + Address + "' , City='" sql += City + "' , State='" + Request.Form("State") + "' , Zip='" sql += Request.Form("Zip") + "' WHERE ID = " + Request.Form("ID") + ";" }
var objConn=Server.CreateObject("ADODB.Connection");
objConn.Open(strConnect)
objConn.Execute(sql)
objConn.Close()
objConn = null;
Response.Write("The member has been updated in the database.")
Response.Write("<A HREF=\"../files/committee.asp\">")
Response.Write("Click here to see it.</A>")
%>
There's no link to see this one in action. I did that for security reasons. I just want to point out a few highlights.
Danger in The Single Quote:
You'll notice that I replace single quote marks with the HTML encoded equivalent. I did that using the following code.
var myRegExp = /[']/g; firstName = firstName.replace(myRegExp, ''');
The single quote is the only character you cannot input into a database using an ASP application. Everything else is fair game. DO NOT accept any text from users into your database without replacing all single quotes. To use an analogy, the single quote is like a key that opens up your entire database. Hackers will tear your application to shreds if you let someone input single quotes.
Execute( ):
The only other thing I want to spend any time with is
评论 (0) All
