<% Response.Write "Hello, World!" %>
<% Response.Write "我的第一个ASP程序" %><% Set conn = Server.CreateObject("ADODB.Connection") conn.Open "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=" & Server.MapPath("/data/mydb.mdb") %>
<% Dim userName, userEmail, userMessage
userName = Request.Form("username") userEmail = Request.Form("email") userMessage = Request.Form("message") %
<% ' 危险的做法 userInput = Request.QueryString("id") sql = "SELECT * FROM users WHERE id = " & userInput
' 安全的做法 userInput = Replace(Request.QueryString("id"), "'", "''") sql = "SELECT * FROM users WHERE id = '" & userInput & "'"
' 更安全的参数化查询 Set cmd = Server.CreateObject("ADODB.Command") cmd.ActiveConnection = conn cmd.CommandText = "SELECT * FROM users WHERE id = ?" cmd.Parameters.Append cmd.CreateParameter("id", adInteger, adParamInput, , userInput) Set rs = cmd.Execute %