繁體中文当前位置: 首页 > 图文教程 > 网络编程 > ASP > javascript asp教程添加和修改
- ASP
- asp下查询xml的实现代码
- 一个asp版XMLDOM操作类
- ASP XML编程objXML.async = False
- asp按关键字查询XML的代码
- asp下用fso和ado.stream写xml文件的方法
- SQL"不能为新插入的行确定标识"错误的解决方法
- asp 类型转换函数大全
- ASP存储过程开发应用详解
- asp 静态页面的另一种思路
- EasyASP v1.5发布(包含数据库操作类，原clsDbCtrl.asp)
- ASP访问数量统计代码
- asp中文数字验证码
- Ajax+asp应用实例 注册模块，表单提交
- 将ASP记录集输出成n列的表格形式显示的方法
- ASP 游标参数详解(ASP记录集)
- 关于ASP循环表格的问题之解答[比较详细]
- ASP Recordset 分页显示数据的方法(修正版)
- ASP ajax分页教程一
- Asp Oracle存储过程返回结果集的代码
- XMLHttp ASP远程获取网页内容代码
ASP 中的 javascript asp教程添加和修改
出处:互联网 整理: 软晨网（RuanChen.com） 发布: 2009-09-13 浏览: 146 ::
收藏到网摘: n/a
The Connection Execute():
If you want to retrieve data from a database then you have no choice but to use a Recordset. However, for the purposes of adding, updating, and deleting data you don't necessarily have to have a Recordset. It's up to you.
For the purposes of adding, updating and deleting you can avoid the Recordset by using the Execute() method.
Get Started:
Below is the script for Lesson 19.
<%@LANGUAGE="JavaScript"%>
var strConnect="Provider=Microsoft.Jet.OLEDB.4.0; Data Source="
strConnect += Server.MapPath("\\GOP") + "\\datastores\\gop.mdb;"
<!-- METADATA TYPE="typelib"
FILE="C:\Program Files\Common Files\System\ado\msado15.dll" -->
<HTML>
<HEAD>
<TITLE>Administrator Page - Changing the Mailing List</TITLE>
</HEAD>
<BODY LINK="red" VLINK="red" ALINK="crimson">
<H2>Administrator Page</H2>
<H3>Changing a the Mailing List</H3>
<%
if (Request.Form("Delete") > "") { var sql="DELETE FROM Address WHERE ID = " + Request.Form("ID") + ";" }
else { var firstName = new String(Request.Form("firstName")) var lastName = new String(Request.Form("lastName")) var Address = new String(Request.Form("Address")) var City = new String(Request.Form("City")) var myRegExp = /[']/g; firstName = firstName.replace(myRegExp, '''); lastName = lastName.replace(myRegExp, '''); Address = Address.replace(myRegExp, '''); City = City.replace(myRegExp, '''); var sql="UPDATE Address SET firstName= '" + firstName + "' , lastName='" sql += lastName + "' , Address='" + Address + "' , City='" sql += City + "' , State='" + Request.Form("State") + "' , Zip='" sql += Request.Form("Zip") + "' WHERE ID = " + Request.Form("ID") + ";" }
var objConn=Server.CreateObject("ADODB.Connection");
objConn.Open(strConnect)
objConn.Execute(sql)
objConn.Close()
objConn = null;
Response.Write("The member has been updated in the database.")
Response.Write("<A HREF=\"../files/committee.asp\">")
Response.Write("Click here to see it.</A>")
%>
There's no link to see this one in action. I did that for security reasons. I just want to point out a few highlights.
Danger in The Single Quote:
You'll notice that I replace single quote marks with the HTML encoded equivalent. I did that using the following code.
var myRegExp = /[']/g; firstName = firstName.replace(myRegExp, ''');
The single quote is the only character you cannot input into a database using an ASP application. Everything else is fair game. DO NOT accept any text from users into your database without replacing all single quotes. To use an analogy, the single quote is like a key that opens up your entire database. Hackers will tear your application to shreds if you let someone input single quotes.
Execute( ):
The only other thing I want to spend any time with is
评论 (0) All
