如何使用 ASP 过滤从数据库中解析的数据

Question

I've recently got my hands on an ASP project that was quite a mess. I'm not familiar with the language but after spending some time searching the Internet I've managed to learn it but I'm still unfamiliar with the database queries etc.

So here's the problem, I've got this code that gets data from an MS Access database file. What I want is to filter this data based on the post/get parameters passed.

Here's the code I have so far:

sql = "SELECT * FROM tyres"

if len(brand1) > 2 then 
     sql = sql & " WHERE brand = '" & brand1 & "' AND application = '" & season1 & "'"

if len(brand2) > 2 then 
     sql = sql & " or brand = '" & brand2 & "' AND application = '" & season2 & "'"

if len(brand3) > 2 then 
    sql = sql & " or brand = '" & brand3 & "' AND application = '" & season3 & "'"

if len(brand4) > 2 then 
    sql = sql & " or brand = '" & brand4 & "' AND application = '" & season4 & "'"

if len(brand5) > 2 then 
    sql = sql & " or brand = '" & brand5 & "' AND application = '" & season5 & "'"

set Dataconn = Server.CreateObject("ADODB.Connection") 
Dataconn.Open "database-in"
set DataTable = Server.CreateObject("ADODB.recordset")
DataTable.Open sql, Dataconn

And it doesn't seems to work. Note that the user is able to insert up to 5 (as you can see) different parameters in order to search for the products in the db. So if you have any further info on how to make this work feel free to suggest.

Answer 1

It is highly unwise to create SQL from string concatenation, and even right-out dangerous if those strings partly come from user input.

Database libraries such as ADODB have commands and parameters for this situation. They use a fixed SQL string with placeholders and the library makes sure that nothing bad can happen, no matter what the user-supplied values may be.

This also means we can prepare an SQL statement up-front and re-use it many times throughout the lifetime of the page.

Dim Conn ' As ADODB.Connection
Dim Cmd  ' As ADODB.Command

Set Conn = Server.CreateObject("ADODB.Connection")
Set Cmd = Server.CreateObject("ADODB.Command")

Conn.Open "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=D:\path\to\your\database.accdb;"

' prepare a reusable command with parameters (i.e. placeholders)
With Cmd
  Set .ActiveConnection = Conn
  .CommandType = adCmdText
  .CommandText = "SELECT Field1, Field2, Field3 WHERE brand = @brand AND application = @season"

  ' set up the parameters for each placeholder
  '  - use proper datatypes here, as per your DB
  '  - varchar types need a defined length
  .Parameters.Append .CreateParameter("@brand", adVarChar, , 50)
  .Parameters.Append .CreateParameter("@season", adVarChar, , 100)
End With

' helper function that operates the Command object and returns a RecordSet
Function SearchTyres(brand, season)
  Cmd.Parameters("@brand", brand)
  Cmd.Parameters("@season", season)
  Set SearchTyres = Cmd.Execute
End With

It's convenient to be able to use the ADODB-specific constants such as adCmdText or adVarChar in your code. To have them available anywhere without fuss, you need to declare the ADODB type library in your global.asa file (create one if you don't have it), adding this to the top of the file:

<!--metadata 
    type="TypeLib" 
    name="Microsoft ActiveX Data Objects 6.1 Library" 
    uuid="B691E011-1797-432E-907A-4D8C69339129"
    version="6.1"
-->

Now you can use this in your page, for example:

If Len(brand1) > 2 Then
  With SearchTyres(brand1, season1)
    ' ...let's do something with the RecordSet
    While Not .EOF
      Response.Write Server.HTMLEncode(!Field1) & "<br>"
      .MoveNext
    Wend
  End With
End If

Notes

• Don't do SELECT * - always write out the fields you want to have.
• Declaring the type library is not strictly necessary, but if you don't, then you have to define all the constants like adVarChar yourself, and that's much more hassle than it's worth.

• With SearchTyres(...) is convenience shorthand for

  Dim Rs Set Rs = SearchTyres(...) With Rs '... End With

• Rs!Field1 is convenience shorthand for Rs.Fields("Field1") . Inside a With Rs block, the Rs itself is optional, so a plain !Field1 is actually meaningful.

• Lastly, it can help to create code in the VBA IDE of an MS Office product (such as Word). Use Tools/References to reference the same ADODB type library. VBA and VBS are not 100 code-compatible, but the VBA IDE has Intellisense, a proper debugger, uses the same objects and code can be transferred to ASP with minimal changes.

Answer 2

Since everyone else is busy bashing you instead of actually answering your question of how to build your sql string:

<%

    SqlStr = "SELECT * FROM Tyres WHERE 1 = 1 " 
    If Len(brand1) > 2 OR  Len(brand2) > 2 OR  Len(brand3) > 2 OR  Len(brand4) > 2 OR  Len(brand5) > 2 Then
        BrandInStr = " AND brand IN("
            If Len(brand1) > 2 Then
                BrandInStr = BrandInStr & "'" & brand1 & "',"    
            End If          
            If Len(brand2) > 2 Then
                BrandInStr = BrandInStr & "'" & brand2 & "',"    
            End If              
            If Len(brand3) > 2 Then
                BrandInStr = BrandInStr & "'" & brand3 & "',"    
            End If              
            If Len(brand4) > 2 Then
                BrandInStr = BrandInStr & "'" & brand4 & "',"    
            End If                  
            If Len(brand5) > 2 Then
                BrandInStr = BrandInStr & "'" & brand5 & "',"    
            End If  
        BrandInStr = Left(BrandInStr,Len(BrandInStr)-1)             
        BrandInStr = BrandInStr & ") "
    End If
    If Len(season1) > 2 OR  Len(season2) > 2 OR  Len(season3) > 2 OR  Len(season4) > 2 OR  Len(season5) > 2 Then
        SeasonInStr = " AND Season IN("
            If Len(Season1) > 2 Then
                SeasonInStr = SeasonInStr & "'" & Season1 & "',"    
            End If          
            If Len(Season2) > 2 Then
                SeasonInStr = SeasonInStr & "'" & Season2 & "',"    
            End If              
            If Len(Season3) > 2 Then
                SeasonInStr = SeasonInStr & "'" & Season3 & "',"    
            End If              
            If Len(Season4) > 2 Then
                SeasonInStr = SeasonInStr & "'" & Season4 & "',"    
            End If      
            If Len(Season5) > 2 Then
                SeasonInStr = SeasonInStr & "'" & Season5 & "',"  
            End If  
        SeasonInStr = Left(SeasonInStr,Len(SeasonInStr)-1)              
        SeasonInStr = SeasonInStr & ") "
    End If

    SqlStr = SqlStr & BrandInStr & " " & SeasonInStr

%>

However if your variables are passed as a single comma delimeted string (instead of numbered) it would be much easier

<%

    SqlStr = "SELECT * FROM Tyres WHERE 1 = 1 "

    If Len(Trim(Replace(Replace(Brand," ",""),",","") > 0 Then
       SqlStr = SqlStr & "AND Brand In('" & Replace(Brand,",","','") & "') "
    End If


    If Len(Trim(Replace(Replace(Season," ",""),",","") > 0 Then
       SqlStr = SqlStr & "AND Season In('" & Replace(Season,",","','") & "') "
    End If

%>