ASP Classic VBscript 参数化 SQL 查询? [英] ASP Classic VBscript Parameterized SQL Query?
问题描述
第一次发帖,但感谢您到目前为止从该网站获得的所有帮助.
First post but thank you for all the help I've gotten from this site so far.
我正在尝试参数化 SQL 查询:
I'm trying to parameterize an SQL query:
query_url = Request.QueryString("ID")
Set rs = Server.CreateObject("ADODB.Recordset")
Set cmd = server.createobject("ADODB.Command")
cmd.ActiveConnection = Internet_String
cmd.CommandType = adCmdText
cmd.CommandText = "SELECT NAME FROM OWNER.TABLE WHERE ID = " + "?" + ""
Set param = cmd.CreateParameter(, , ,200 , Replace(query_url, "'", "''"))
cmd.Parameters.Append param
Set rs = cmd.Execute()
所以如果我使用(无参数):
So if I use (no parameters):
SELECT NAME FROM OWNER.TABLE WHERE ID = " + Replace(query_url, "'", "''") + ""
它工作正常,所以我知道我的数据库连接和 query_url 工作正常.我在参数化查询中的 SQL 语句有问题吗?我已经尝试了很多不同的方法.
It works fine, so I know my DB connection and query_url are working. Is something wrong with my SQL statement in the parameterized query? I've tried it so many different ways.
当我在 Dreamweaver 中运行参数化查询时,页面不会随时加载,只会无限旋转,我假设它没有从数据库中得到响应.
When I run my parameterized query in Dreamweaver the page will not load anytime, just spins infinitely, I'm assuming it's not getting a response back from the DB.
谢谢!
编辑
好的,谢谢你到目前为止的帮助,我越来越近了.页面现在加载,但字段仍然是空白的,这是我到目前为止所得到的:
Alright thanks for the help so far, I'm getting closer. The page loads now but the fields are still blank, heres what I've got so far:
Set rs = Server.CreateObject("ADODB.Recordset")
Set cmd = server.createobject("ADODB.Command")
cmd.ActiveConnection = internet_string
cmd.CommandType = adCmdText
cmd.CommandText = "SELECT NAME FROM OWNER.TABLE WHERE ID = @param"
Set param = cmd.CreateParameter("@param", , ,200 , query_url)
cmd.Parameters.Append param
response.Write(param)
Set rs = cmd.Execute()
这是我引用数据的方式:
Here's how I'm referencing the data:
<strong>Name: <%=(rs.Fields.Item("NAME").Value)%></strong>
有什么想法吗?
推荐答案
使用命名占位符;
cmd.CommandText = "SELECT NAME FROM OWNER.TABLE WHERE ID = @ID"
然后提供它的值
Set param = cmd.CreateParameter("@ID", , ,200, Replace(query_url, "'", "''"))
仅供参考,您不需要在参数化查询中转义 '
FYI you do not need to escape ' in an parameterized query
这篇关于ASP Classic VBscript 参数化 SQL 查询?的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!