繁體中文当前位置: 首页 > 图文教程 > 网络编程 > ASP > javascript asp教程添加和修改
- ASP
- asp OpenTextFile文本读取与写入实例代码
- 在ASP编程中nothing代表什么意思?
- asp之让Session永不过期
- ASP获取ACCESS数据库表名及结构的代码
- 推荐一篇不错的新手asp编程的基本法则
- 最简洁的asp多重查询的解决方案
- ASP 判断是否有中文的代码
- asp.net常用函数收藏
- asp下几种常用排序算法
- asp获取数据库中表名和字段名的代码
- 简单的asp采集代码教程
- asp生成带有样式的word文件方法
- 实用301转向到另一域名相应页面的asp代码
- asp伪继承初探_实例代码
- asp代理采集的核心函数代码
- js table排序类代码
- ASP UTF-8页面乱码+GB2312转UTF-8 +生成UTF-8格式的文件(编码)
- Asp生成RSS的类_给网站加上RSS
- utf-8 网页不显示+utf-8网页乱码的通用解决方法
- asp截取指定英汉混合字符串_支持中文
ASP 中的 javascript asp教程添加和修改
出处:互联网 整理: 软晨网（RuanChen.com） 发布: 2009-09-13 浏览: 131 ::
收藏到网摘: n/a
The Connection Execute():
If you want to retrieve data from a database then you have no choice but to use a Recordset. However, for the purposes of adding, updating, and deleting data you don't necessarily have to have a Recordset. It's up to you.
For the purposes of adding, updating and deleting you can avoid the Recordset by using the Execute() method.
Get Started:
Below is the script for Lesson 19.
<%@LANGUAGE="JavaScript"%>
var strConnect="Provider=Microsoft.Jet.OLEDB.4.0; Data Source="
strConnect += Server.MapPath("\\GOP") + "\\datastores\\gop.mdb;"
<!-- METADATA TYPE="typelib"
FILE="C:\Program Files\Common Files\System\ado\msado15.dll" -->
<HTML>
<HEAD>
<TITLE>Administrator Page - Changing the Mailing List</TITLE>
</HEAD>
<BODY LINK="red" VLINK="red" ALINK="crimson">
<H2>Administrator Page</H2>
<H3>Changing a the Mailing List</H3>
<%
if (Request.Form("Delete") > "") { var sql="DELETE FROM Address WHERE ID = " + Request.Form("ID") + ";" }
else { var firstName = new String(Request.Form("firstName")) var lastName = new String(Request.Form("lastName")) var Address = new String(Request.Form("Address")) var City = new String(Request.Form("City")) var myRegExp = /[']/g; firstName = firstName.replace(myRegExp, '''); lastName = lastName.replace(myRegExp, '''); Address = Address.replace(myRegExp, '''); City = City.replace(myRegExp, '''); var sql="UPDATE Address SET firstName= '" + firstName + "' , lastName='" sql += lastName + "' , Address='" + Address + "' , City='" sql += City + "' , State='" + Request.Form("State") + "' , Zip='" sql += Request.Form("Zip") + "' WHERE ID = " + Request.Form("ID") + ";" }
var objConn=Server.CreateObject("ADODB.Connection");
objConn.Open(strConnect)
objConn.Execute(sql)
objConn.Close()
objConn = null;
Response.Write("The member has been updated in the database.")
Response.Write("<A HREF=\"../files/committee.asp\">")
Response.Write("Click here to see it.</A>")
%>
There's no link to see this one in action. I did that for security reasons. I just want to point out a few highlights.
Danger in The Single Quote:
You'll notice that I replace single quote marks with the HTML encoded equivalent. I did that using the following code.
var myRegExp = /[']/g; firstName = firstName.replace(myRegExp, ''');
The single quote is the only character you cannot input into a database using an ASP application. Everything else is fair game. DO NOT accept any text from users into your database without replacing all single quotes. To use an analogy, the single quote is like a key that opens up your entire database. Hackers will tear your application to shreds if you let someone input single quotes.
Execute( ):
The only other thing I want to spend any time with is
评论 (0) All
