通过经典的asp和vbscript更新sql server
||
我正在尝试更新单个客户的详细信息,但是在使用新用户输入进行更新时遇到了问题。我可以看到更改已通过,但未更新sql。这是代码-
\'Update\'
updateC = request.QueryString(\"action\")
if updateC = \"update\" then
Id = request.QueryString(\"Id\")
Name = request.QueryString(\"Name\")
Address = request.QueryString(\"Address\")
Suburb = request.QueryString(\"Suburb\")
Postcode = request.QueryString(\"Postcode\")
Age = request.QueryString(\"Age\")
Email = request.QueryString(\"Email\")
end if
%>
<form method=\"get\" action=\"CreateCustomer.asp\">
Name: <input type=\"text\" value=\"<%=Name %>\" name=\"Name\"><br/>
Address: <input type=\"text\" value=\"<%=Address %>\" name=\"Address\"><br/>
Suburb: <input type=\"Suburb\" value=\"<%=Suburb %>\" name=\"Suburb\"><br/>
Postcode: <input type=\"text\" value=\"<%=Postcode %>\" name=\"Postcode\"><br/>
Age: <input type=\"text\" value=\"<%=Age %>\" name=\"Age\"><br/>
Email: <input type=\"text\" value=\"<%=Email %>\" name=\"Email\"><br/><br/>
<% if updateC = \"update\" then%>
<input type=\"hidden\" value=\"update\" name=\"updateButton\">
<input type=\"submit\" value=\"Update Customer\">
<% else %>
<input type=\"hidden\" value=\"insert\" name=\"insert\">
<input type=\"submit\" value=\"New Customer\">
<% end if %>
</form>
<%
\'Assign Variables\'
insertCheck = request.QueryString(\"insert\")
updCheck = request.QueryString(\"updateButton\")
if insertCheck = \"insert\" or updCheck = \"update\" then
ID = request.QueryString(\"Id\")
Name = request.QueryString(\"Name\")
Address = request.QueryString(\"Address\")
Suburb = request.QueryString(\"Suburb\")
Postcode = request.QueryString(\"Postcode\")
Age = request.QueryString(\"Age\")
Email = request.QueryString(\"Email\")
end if
\'update customer\'
updButton = request.QueryString(\"updateButton\")
if updButton = \"update\" and name<>\"\" then
updateCustomer()
end if
\'Update customer sub procedure\'
sub updateCustomer()
Dim uSQL, objCon
Set objCon = CreateObject(\"ADODB.Connection\")
objCon.Open \"Provider=SQLOLEDB.1;Password=xxxx;Persist Security Info=True;User ID=xxxx;Initial Catalog=Customer;Data Source=PC\"
uSQL = \"UPDATE Customer SET Name = \" & \"\'\" & Name & \"\'\" & \" Where ID = \" & \"\'\" & Id & \"\'\"
objCon.Execute(uSQL)
uSQL = \"UPDATE Customer SET Address = \" & \"\'\" & Address & \"\'\" & \" Where ID = \" & \"\'\" & Id & \"\'\"
objCon.Execute(uSQL)
uSQL = \"UPDATE Customer SET Suburb = \" & \"\'\" & Suburb & \"\'\" & \" Where ID = \" & \"\'\" & Id & \"\'\"
objCon.Execute(uSQL)
uSQL = \"UPDATE Customer SET Postcode = \" & \"\'\" & Postcode & \"\'\" & \" Where ID = \" & \"\'\" & Id & \"\'\"
objCon.Execute(uSQL)
uSQL = \"UPDATE Customer SET Age = \" & \"\'\" & Age & \"\'\" & \" Where ID = \" & \"\'\" & Id & \"\'\"
objCon.Execute(uSQL)
uSQL = \"UPDATE Customer SET Email = \" & \"\'\" & Email & \"\'\" & \" Where ID = \" & \"\'\" & Id & \"\'\"
objCon.Execute(uSQL)
objCon.Close
end sub
上面的代码来自createcustomer.asp,下面的代码来自table.asp
<td><Center><a href=\"CreateCustomer.asp?action=update&Id=<%= objRS(\"Id\") %>&Name=<%= objRS(\"Name\") %>&Address=<%= objRS(\"Address\") %>&suburb=<%= objRS(\"Suburb\") %>&postcode=<%= objRS(\"Postcode\") %>&age=<%= objRS(\"Age\") %>&email=<%= objRS(\"Email\") %>\">
<input type=\"submit\" value=\"Update\"></a></Center></td>
没有找到相关结果
已邀请:
2 个回复
糕泰灌
至
因为在您当前的代码中,您没有传递客户的ID,所以update方法不知道要更新的人。 正如其他人所说的,尽管还有很多改进的余地,例如 通过清理输入或使用参数化查询来避免SQL注入攻击。 一次更新记录,而不是每个字段field4。 重用已声明的变量,而不是在需要任何内容时都读取ѭ5(变量中已包含大多数值)
烫珊
至