ASP beginners often make a few mistakes (ZT) _asp Foundation

1. Open the Recordset again before closing:
------------------------------------
Sql= "SELECT * FROM Test"
Rs.Open sql,conn,1,1
If not rs.eof then
Dim myname
Myname=rs ("name")
End If
Sql= "SELECT * from MyBook"
Rs.Open sql,conn,1,1
-------------------------------------
Resolve: Close Rs.close before rs.open the second time
Or
Set Rs1=server.createobject
Rs1.open sql,conn,1,1

2, use SQL keyword to do table name or field name
-------------------------------------
Sql= "SELECT * from User"
Rs.Open sql,conn,1,1
-------------------------------------
User is the SQL keyword
Resolution: Change to
Sql= "SELECT * from [user]"


3, with the lock way to update
-------------------------------------
Sql= "SELECT * from [user]"
Rs.Open sql,conn,1,1
Rs.addnew
Or
RS ("userName") = "AA"
Rs.update
-------------------------------------
The current recordset is open in read-only mode
Solve:
To
Rs.Open sql,conn,1,3

4, the Contrast field value used in the query statement does not match the field type
-----------------------------------------
Sql= "SELECT * from [user] where id= '" & MyID & "'"
Rs.Open sql,conn,1,1
-----------------------------------------
Suppose that the design ID in the table is a numeric type, then an error occurs.
Solve:
Sql= "SELECT * from [user] where id=" & MyID

5, error not checking variable value
-----------------------------------------
Sql= "SELECT * from [user] where id=" & MyID
Rs.Open sql,conn,1,1
-----------------------------------------
Assuming the myID variable is null at this time, then SQL becomes
Sql= "SELECT * from [user] where id="
Solve:
Add in front
If IsNull (MyID) then error prompt

6, error not checking variable value type
-----------------------------------------
Sql= "SELECT * from [user] where id=" & MyID
Rs.Open sql,conn,1,1
-----------------------------------------
Assuming the ID is numeric, the myID variable is not NULL at this time, but is a character, such as myID at this time as "AA"
Then SQL will become
Sql= "SELECT * from [user] where Id=aa"
Solve:
Add in front
If IsNumeric (MyID) =false then error prompt

This can also be an effective way to prevent SQL injection vulnerabilities.

7, due to NTFS permissions on the directory where the database files are located, ' cannot be updated. Database or object is read-only error.
Description
The Win2K system extends NTFS permissions on the WINNT system.
There are default security settings for folders in the system.
The system default user for WWW access through HTTP is the IUSR_ computer name user, which belongs to the guest group.
When accessed over HTTP, you can modify the data either by ASP or JSP, or by PHP or. NET programs:
Like what:
When opening an article, the program set, the article read the number of times = original reading +1
Perform
Conn.execute ("Update arts set clicks=clicks+1 where Id=n")
Statement, an error occurs if the IUSR_ computer name user does not have write access to the database.
Workaround:
Locate the directory where the database resides
Right Key Properties Security tab set the Write permission for the IUSR_ computer name (or everyone, of course)