|
|
A parameterised query is where you put a placeholder in the query string in your code and add a parameter object to the command which the framework will send to the database system. The separation of the query code from the variable data elements reduces the possibility of a SQL Injection Attack as the injected string can no longer have an effect on the SQL code.
A stored procedure is just a procedure that is written in SQL, not all database systems support the concept. Access supports a sort of semi-stored procedure like concept called Stored Queries which appear to be like a view that accepts parameters.
Some databases may not support Stored Procedures (e.g. MySQL doesn't yet support them, although I believe that the next version will).
Here are some links that show how parameterised queries work:
http://www.4guysfromrolla.com/webtech/021799-1.shtml[^]
http://www.4guysfromrolla.com/webtech/111798-1.shtml[^]
I don't full like the next example. It shows how to build an MS Access Stored Query that accepts parameters (so it is a sort of half way house between a Stored Procedure and a View - it takes parameters, but it can only perform a single select) but the code to call the query is open to an SQL Injection Attack as it just injects the values into an SQL String in order to call the "Access Stored Query" object:
http://www.xefteri.com/articles/show.cfm?id=6[^]
If these links don't help (they were just the first few results in a google search) it should be fairly easy to find more examples with the keywords or variations on them: Parameterized Query ADO
My: Blog | Photos | Next SQL Presentation
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More
|
|
|
|
|
I have a section on my page which allows a user to login. When successful, I save true in a session variable called Session("isLoggedOn").
I have a menu on the left hand side of each page, and depending if the user is logged on or not displays Login (if isLoggedOn = false), or log off (if isLoggedOn is true). So when the user logs off, I use Session.Abandon at the top of the page, but the menu still displays Log off. How do I change this so that it changes Log off to Login as the session is only abandoned when the page has fully loaded.
Help would be appreciated.
|
|
|
|
|
You could set Session("isLoggedOn") to false at the top of the page as well as using Session.Abandon
|
|
|
|
|
I need to know what is the best way to test if 2 string are 100% the same. This I use to test if my password is the same as the password in my "confirm password" textbox.
I have it as:
if(string1 == string2)
// Strings are equal
Help would be appreciated.
|
|
|
|
|
Doesnt that work for you? I have string comparisons within my own code and I have the same thing and it seems to work fine.
What exactly is the problem that you are having?
Did I post well? Rate it! Did I post badly? Rate that too!
|
|
|
|
|
Try uppercase both strings.
<italic>Work hard, Work effectively and a bit of luck is the key to success.
|
|
|
|
|
I have a web application using classic ASP. It displays products on a page, from which the user can select. There are 30 products per page, and there are 120 products in total. So it is 4 pages.
When the user selects products, he can go to the next page, and also select a couple of products. But the products chosen from the previous page must still be available somewhere, maybe in a session variable, or something. Lets say the user chose product A from the first page and wants to delete it, he must just deselect the checkbox and it should be taken out of the session.
Can someone please explain to me how this can be done, and if session variables are the only solution to my problem. Maybe javascript can be used as well.
Help would be appreciated.
Brendan
|
|
|
|
|
Hi Brendan:
You seem to feel that using a session is something that you dont want to do although I am not entirely sure why. Usually when you are working ASP you use a session to persist variables throughout the website.
You cant really use Javascript because if you do then you will lose track of the variable as soon as you switch pages. Javascript isnt really intended for this.
I hope this answers your question, please ask more if you have them!
Jamieson
Did I post well? Rate it! Did I post badly? Rate that too!
|
|
|
|
|
I would suggest you use cookies through JavaScript.
Google the phrase "javascript cookies" and you will find alot of information about them.
theJazzyBrain
Excellence is not an act, but a habit! Aristotle
|
|
|
|
|
An alternative to Cookies is to define a session variable using the navigator object, e.g.
window.navigator.session = "[put session info here]";
This defined variable is persistent for as long as the browser window is open, no matter how many new pages are loaded. You can use it just like a Cookie to track session information and it can be modified just like any other string variable.
|
|
|
|
|
I am writing a client/server application and users are going to be accessing server side documents via their web browser. I was wandering if there is any client side event like an "onsave" event so that i can capture when users go to "File > Save As".
I need this becouse i have a script that i am going to modify that goes into the clients machine and uploads files onto the server. In this scenerio, if the user is revising a server side document and clicks "File > Save As" i will prompt the user and ask if he/she would like to save the file on the server also. If they pick yes then i will overwrite the server side document with their local modified document.
Any ideas about how to get this to work or what event i can use?
|
|
|
|
|
I use dll in web application but dllhost use meny memory please help me .
|
|
|
|
|
To stream the live video from webcam and stream in intrenet explorer in system( as server) and sending that output as to the (PPC)Pocket PC (as client) as input and stream in PPC in internet explorer.
plz, if anybody done this before or related to this, send sample code.
help me to do this.valuable suggestions are welcome.
very urgent.thanx.
|
|
|
|
|
Hi
Im accessing the client Web Service. Im giving the proxy setting through IWebProxy interface.
When i connect to the Webservice first time it doesnt get connected but if i connect to the webservice through IE by .asmx file and then access through the Application then it access the WS.
but after some time if i try to access again trough app then again shows error of connection failed.
|
|
|
|
|
ASP VB Script
If I use:
If MemberId = CInt(rso.Fields("MemberId").Value) Then Response.Write("selected")
I get no error, and I can add and update record. But I can not Delet record.
If I use
If intMemberId = CInt(rso.Fields("MemberId").Value) Then Response.Write("selected")
I gett an error when I shal add an new error. But I can update record and delet record
I am new on this so there is something I miss
Thanks for any help
Erik Gjertsen
|
|
|
|
|
Have you declare intMemberId?
<italic>Work hard, Work effectively and a bit of luck is the key to success.
|
|
|
|
|
I am new on this, So I need an explain what you mean
Thansk
Erik Gjertsen
|
|
|
|
|
Declare the variable with Dim intNumber. Have you declare that?
<italic>Work hard, Work effectively and a bit of luck is the key to success.
|
|
|
|
|
Thanks
Erik Gjertsen
<%@ LANGUAGE="VBScript"%><br />
<br />
<br />
<%<br />
Dim rso<br />
Dim strAction<br />
Dim intMemberId<br />
Dim sqlStatement<br />
Dim strFirstname<br />
Dim strLastname<br />
Dim strAddress<br />
Dim intPostalCode<br />
Dim strPostalOffice<br />
Dim strEmail<br />
Dim ErrorMessage<br />
Dim strMemberImage<br />
Dim strCategoryid<br />
<br />
ErrorMessage = ""<br />
sqlStatement = ""<br />
strAction = Request.Form("action")<br />
Set rso = Server.CreateObject("ADODB.RecordSet")<br />
If CInt("0" & Request.QueryString("memberid")) <> 0 Then<br />
intMemberId = CInt("0" & Request.QueryString("memberid"))<br />
Call GetMemberInformation()<br />
ElseIf CInt("0" & Request.Form("memberid")) <> 0 Then<br />
intMemberId = CInt("0" & Request.Form("memberid"))<br />
Else<br />
intMemberId = 0<br />
End If<br />
<br />
If REQUEST_METHOD="POST" Then<br />
Select Case strAction<br />
Case "get"<br />
GetMemberInformation()<br />
Case "save"<br />
Call SaveMember()<br />
Case "delete"<br />
Call DeleteMember()<br />
Case "new"<br />
Call NewMember()<br />
Case "upload_image"<br />
Response.Redirect("UploadFile.asp?memberid=" & intMemberId)<br />
End Select<br />
End If<br />
<br />
Private Sub SaveMember()<br />
Dim arrSql(6)<br />
<br />
If "" & Request.Form("firstname") = "" Then ErrorMessage = ErrorMessage & "Fornavn kan ikke være tomt!<br>"<br />
If "" & Request.Form("lastname") = "" Then ErrorMessage = ErrorMessage & "Etternavn kan ikke være tomt!<br>"<br />
If "" & Request.Form("postalcode") = "" Then ErrorMessage = ErrorMessage & "Postnummer kan ikke være tomt!<br>"<br />
If ValidatePostalCode(CInt("0" & Request.Form("postalcode"))) = 0 Then ErrorMessage = ErrorMessage & "Du har ikke tastet inne et gyldig postnummer!<br>"<br />
<br />
If ErrorMessage = "" Then<br />
arrSql(0) = "'" & Request.Form("firstname") & "'"<br />
arrSql(1) = "'" & Request.Form("lastname") & "'"<br />
arrSql(2) = "'" & Request.Form("address") & "'"<br />
arrSql(3) = Request.Form("postalcode")<br />
arrSql(4) = "'" & Request.Form("email") & "'"<br />
arrSql(5) = "'" & Request.Form("CategoryID") & "'"<br />
<br />
<br />
If intMemberId = 0 Then<br />
sqlStatement = "INSERT INTO [Member] (Firstname, Lastname, Address, PostalCode, Email, CategoryID) VALUES (" & arrSql(0) & ", " & arrSql(1) & ", " & arrSql(2) & ", " & arrSql(3) & ", " & arrSql(4) & ", " & arrSql(5)& ")"<br />
Else<br />
sqlStatement = "UPDATE [Member] SET [Firstname]=" & arrSql(0) & ", [Lastname]=" & arrSql(1) & ", [Address]=" & arrSql(2) & ", [PostalCode]=" & arrSql(3) & ", [Email]=" & arrSql(4) & ", [CategoryID]=" & arrSql(5) & " WHERE MemberId=" & intMemberId<br />
End If<br />
<br />
On Error Resume Next<br />
DbConnection.Execute(sqlStatement)<br />
On Error Goto 0<br />
<br />
If intMemberId = 0 Then<br />
sqlStatement = "SELECT @@Identity AS MemberId"<br />
<br />
On Error Resume Next<br />
Set rso = DbConnection.Execute(sqlStatement)<br />
On Error Goto 0<br />
<br />
If Not rso.EOF Then<br />
intMemberId = rso.Fields("MemberId").Value<br />
End If<br />
<br />
Set rso = Nothing<br />
End If<br />
<br />
Call GetMemberInformation()<br />
End If<br />
End Sub<br />
<br />
Private Sub DeleteMember()<br />
sqlStatement = "DELETE FROM Member WHERE MemberId=" & intMemberId<br />
<br />
On Error Resume Next<br />
DbConnection.Execute(sqlStatement)<br />
On Error Goto 0<br />
<br />
Call NewMember()<br />
End Sub<br />
<br />
Private Sub NewMember()<br />
intMemberId = 0<br />
strFirstname = ""<br />
strLastname = ""<br />
strAddress = ""<br />
intPostalCode = "0000"<br />
strPostalOffice = ""<br />
strEmail = ""<br />
strCategoryID = ""<br />
End Sub<br />
<br />
Private Sub GetMemberInformation()<br />
sqlStatement = ""<br />
sqlStatement = sqlStatement & "SELECT m.[Firstname], m.[Lastname], m.[Address], m.[PostalCode], p.[PostalOffice], m.[Email], m.[MemberImage], m.[CategoryID] "<br />
sqlStatement = sqlStatement & "FROM [Member] m, [Post] p "<br />
sqlStatement = sqlStatement & "WHERE m.[PostalCode]=p.[PostalCode] AND m.[MemberId]=" & intMemberId<br />
<br />
On Error Resume Next<br />
Set rso = DbConnection.Execute(sqlStatement):CheckError(sqlStatement)<br />
On Error Goto 0<br />
<br />
If Not rso.EOF Then<br />
strFirstname = rso.Fields("Firstname").Value<br />
strLastname = rso.Fields("Lastname").Value<br />
strAddress = rso.Fields("Address").Value<br />
intPostalCode = PrepNrAsPostalCode(rso.Fields("PostalCode").Value)<br />
strPostalOffice = rso.Fields("PostalOffice").Value<br />
strEmail = rso.Fields("EMail").Value<br />
strMemberImage = rso.Fields("MemberImage").Value<br />
strCategoryID = rso.Fields("CategoryID").Value<br />
End If<br />
<br />
Set rso = Nothing<br />
End Sub<br />
%><br />
<html><br />
<head><br />
<title>Medlemsdetaljer</title><br />
<br />
<script src="Scripts/Scripts.js" language="javascript"></script><br />
</head><br />
<body><br />
<form name="oForm" id="oForm" method="post" action="<%=SCRIPT_NAME%>"><br />
<h4>Detaljinformasjon<br><br />
<a href="Search.asp">Tilbake</a> </h4><br />
<table border="0" cellpadding="2" cellspacing="2" style="border: solid 1px #000000;"><br />
<tr><br />
<td valign="top"><br />
<table cellpadding="2" cellspacing="2" width="100%" border="0"><br />
<% If ErrorMessage <> "" Then rw("<tr><td colspan=""2""><font class=""ErrorLabel"">" & ErrorMessage & "</font></td></tr>") %><br />
<tr><br />
<td><font class="TextLabel">Velg medlem</font></td><br />
<td><br />
<select name="MemberId" id="MemberId" onchange="doPostPage('get');" class="DropDownList"><br />
<option value="">Velg medlem</option><br />
<%<br />
sqlStatement = "SELECT [MemberId], [Firstname], [Lastname] FROM [Member] ORDER BY Lastname"<br />
<br />
On Error Resume Next<br />
Set rso = DbConnection.Execute(sqlStatement):CheckError(sqlStatement)<br />
On Error Goto 0<br />
<br />
Do While Not rso.EOF<br />
Response.Write("<option value=""" & rso.Fields("MemberId").Value & """")<br />
<br />
If intMemberId = CInt("0" & rso.Fields("MemberId").Value) Then Response.Write("selected") <br />
<br />
rw(">" & rso.Fields("Firstname").Value & " " & rso.Fields("Lastname").Value & "</option>")<br />
rso.MoveNext<br />
Loop<br />
<br />
Set rso = Nothing<br />
%><br />
</select><br />
</td><br />
</tr><br />
<tr><br />
<td><font class="TextLabel">Medlems ID</font></td><br />
<td><input type="text" name="memberid" id="memberid" value="<%=PrepareNumber(intMemberId, 5)%>" class="TextBox" readonly="true"/></td><br />
</tr><br />
<tr><br />
<td><font class="TextLabel">Fornavn</font></td><br />
<td><input type="text" name="firstname" id="firstname" value="<%=strFirstname%>" class="TextBox" /></td><br />
</tr><br />
<tr><br />
<td><font class="TextLabel">Etternavn</font></td><br />
<td><input type="text" name="lastname" id="lastname" value="<%=strLastname%>" class="TextBox" /></td><br />
</tr><br />
<tr><br />
<td><font class="TextLabel">Adresse</font></td><br />
<td><input type="text" name="address" id="address" value="<%=strAddress%>" class="TextBox" /></td><br />
</tr><br />
<tr><br />
<td><font class="TextLabel">Postnummer/sted</font></td><br />
<td><br />
<table cellpadding="0" cellspacing="0" border="0"><br />
<tr><br />
<td><input type="text" name="postalcode" id="postalcode" value="<%=intPostalCode%>" class="TextBox" style="width: 80px;" /></td><br />
<td> </td><br />
<td><input type="text" name="postaloffice" id="postaloffice" value="<%=strPostalOffice%>" class="TextBox" style="width: 166px;" readonly="true" /></td><br />
</tr><br />
</table><br />
</td><br />
</tr><br />
<tr><br />
<td><font class="TextLabel">E-Post</font></td><br />
<td><input type="text" name="email" id="email" value="<%=strEMail%>" class="TextBox" /></td><br />
</tr><br />
<tr><br />
<td>Kategori</td><br />
<td><input type="text" name="CategoryID" id="CategoryID" value="<%=strCategoryID%>" class="TextBox" /></td><br />
</tr><br />
</table><br />
</td><br />
<td valign="top"><br />
<% If strMemberImage <> "" Then %><br />
<img src="MedlemsBilder/<%=strMemberImage%>" border="0" width="200" height="200" alt="" /><br />
<% End If %><br />
</td><br />
</tr><br />
<tr><br />
<td colspan="2"><table border="0" cellpadding="0" cellspacing="0" ID="Table1"><br />
<tr><br />
<td><input type="button" value="Lagre" class="Button" onclick="doPostPage('save');" /></td><br />
<td> </td><br />
<td><input type="button" value="Ny" class="Button" onclick="doPostPage('new');" /></td><br />
<br />
<td> </td><br />
<td><input type="button" value="Slett" class="Button" onclick="doPostPage('delete');" /></td><br />
<td> </td><br />
<td><input type="button" value="Last opp bilde" class="Button" onclick="doPostPage('upload_image');" /></td><br />
<br />
</tr><br />
</table><br />
</td><br />
</tr><br />
</table><br />
<input type="hidden" name="action" id="action" value="" /><br />
</form><br />
</body><br />
</html>
|
|
|
|
|
It's hard to check from your code. I suggest you check the query.
use response.write yourSQlStatement. Good luck.
<italic>Work hard, Work effectively and a bit of luck is the key to success.
|
|
|
|
|
While using Security Application Block, the documentation says that the Security Application Block includes a file SecurityDatabase.sql that generates the script for the particular schema. I don't seem to have the script file. If someone has used Security Application Blocks, please let me know if this script should be run and if so where do I download it.
|
|
|
|
|
Hi, I put the java file test.java in the classes folder under WEB-INF. When I run the jsp that references the javabean, it says "cannot find symbol". The jsp files has this line:
<jsp:usebean id="test" class="test" scope="page">
The class in test.java is test (of course).
The reference in jsp is <%= test.method(value); %>.
What's gone wrong?
|
|
|
|
|
I am web developer and used ASP to develop the website. but still i have a problem with sending E-Mail.
I want to know about free CDONTS E-Mail service. Is there anyone to help me ???
Kanchan Subba
|
|
|
|
|
try this[^]
<italic>Work hard, Work effectively and a bit of luck is the key to success.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
