繁體中文当前位置: 首页 > 图文教程 > 网络编程 > ASP > javascript asp教程添加和修改
- ASP
- ASP优化：几招提高ASP性能的最佳选择
- ASP进阶：用ASP制作统计饼图、柱状图等
- ASP应用进阶 ASP Error对象的相关知识
- ASP常见数学函数 Abs Atn Cos 等详解
- ASP优化 用数据绑定实现高效率动态网页
- 用着放心 为你的ASP程序作一个负载测试
- ASP＋Access的安全隐患以及解决方法
- ASP中将视频文件转换成.flv格式
- 经典！5分钟编写一个ASP论坛
- ASP实现小偷程序原理和简单示例
- 用ASP木马实现FTP和解压缩
- 如何用ASP编写网站统计系统
- response.write与之间的区别
- asp操作excel文件的函数
- 如何有效提高asp页面的访问速度
- JS+ASP打造无刷新新闻列表
- 使用VB将ASP代码封装生成DLL文件
- 用ASP打造一个小型的网页BBS系统
- ASP网站的漏洞分解以及入侵防范方法
- 破解网站发布系统 ASP生成静态页面方法
ASP 中的 javascript asp教程添加和修改
出处:互联网 整理: 软晨网（RuanChen.com） 发布: 2009-09-13 浏览: 187 ::
收藏到网摘: n/a
The Connection Execute():
If you want to retrieve data from a database then you have no choice but to use a Recordset. However, for the purposes of adding, updating, and deleting data you don't necessarily have to have a Recordset. It's up to you.
For the purposes of adding, updating and deleting you can avoid the Recordset by using the Execute() method.
Get Started:
Below is the script for Lesson 19.
<%@LANGUAGE="JavaScript"%>
var strConnect="Provider=Microsoft.Jet.OLEDB.4.0; Data Source="
strConnect += Server.MapPath("\\GOP") + "\\datastores\\gop.mdb;"
<!-- METADATA TYPE="typelib"
FILE="C:\Program Files\Common Files\System\ado\msado15.dll" -->
<HTML>
<HEAD>
<TITLE>Administrator Page - Changing the Mailing List</TITLE>
</HEAD>
<BODY LINK="red" VLINK="red" ALINK="crimson">
<H2>Administrator Page</H2>
<H3>Changing a the Mailing List</H3>
<%
if (Request.Form("Delete") > "") { var sql="DELETE FROM Address WHERE ID = " + Request.Form("ID") + ";" }
else { var firstName = new String(Request.Form("firstName")) var lastName = new String(Request.Form("lastName")) var Address = new String(Request.Form("Address")) var City = new String(Request.Form("City")) var myRegExp = /[']/g; firstName = firstName.replace(myRegExp, '''); lastName = lastName.replace(myRegExp, '''); Address = Address.replace(myRegExp, '''); City = City.replace(myRegExp, '''); var sql="UPDATE Address SET firstName= '" + firstName + "' , lastName='" sql += lastName + "' , Address='" + Address + "' , City='" sql += City + "' , State='" + Request.Form("State") + "' , Zip='" sql += Request.Form("Zip") + "' WHERE ID = " + Request.Form("ID") + ";" }
var objConn=Server.CreateObject("ADODB.Connection");
objConn.Open(strConnect)
objConn.Execute(sql)
objConn.Close()
objConn = null;
Response.Write("The member has been updated in the database.")
Response.Write("<A HREF=\"../files/committee.asp\">")
Response.Write("Click here to see it.</A>")
%>
There's no link to see this one in action. I did that for security reasons. I just want to point out a few highlights.
Danger in The Single Quote:
You'll notice that I replace single quote marks with the HTML encoded equivalent. I did that using the following code.
var myRegExp = /[']/g; firstName = firstName.replace(myRegExp, ''');
The single quote is the only character you cannot input into a database using an ASP application. Everything else is fair game. DO NOT accept any text from users into your database without replacing all single quotes. To use an analogy, the single quote is like a key that opens up your entire database. Hackers will tear your application to shreds if you let someone input single quotes.
Execute( ):
The only other thing I want to spend any time with is
评论 (0) All
