Question

我在上传文件并同时将数据插入数据库时遇到问题。它是用经典ASP编写的

 Set Upload = Server.CreateObject("Persits.Upload")
 Upload.OverwriteFiles = False
 Upload.Save Server.MapPath("files/drawings/")

 sql = "Insert into Name(first,last) values ("'" & Request.form("firstname") & "','" & Request.form("lastname") & "' " )
 ADOConn.Execute sql

Answer 1

原因是当您执行上传处理请求为二进制时，这会使Request.Form集合失效（就像您调用Request.BinaryRead()一样。）为了解决此问题，ASPUpload组件提供了{{ 3}}它自己的，包含发布的表单值。

将值Request.Form更改为Upload.Form可以解决此问题。

Set Upload = Server.CreateObject("Persits.Upload")
Upload.OverwriteFiles = False
Upload.Save Server.MapPath("files/drawings/")

'Also make sure the string concatenation is correct (had extra " in after "values")
sql = "Insert into Name(first,last) values ('" & Upload.Form("firstname") & "','" & Upload.Form("lastname") & "' " )
ADOConn.Execute sql

警告上述代码段未经过清理并向Form Collection开放，请考虑在执行前使用ADODB.Command对象对参数进行参数化（对数据的一些假设类型和大小已经制作）。

快速示例

 Dim cmd, conn, sql

 conn = "your connection string"
 'Parametrised query
 sql = "Insert into Name(first,last) values (?, ?)"

 Set cmd = Server.CreateObject("ADODB.Command")
 With cmd
   'No need to pass ADODB.Connection pass connection string and
   'the ADODB.Command will do it for you.
   .ActiveConnection = conn
   .CommandType = adCmdText
   .CommandText = sql
   Call .Parameters.Append(.CreateParameter("first", adVarWChar, adParamInput, 100))
   Call .Parameters.Append(.CreateParameter("last", adVarWChar, adParamInput, 100))
   'Not returning any records just inserting
   Call .Execute(adExecuteNoRecords)
 End With
 'Clean-up
 Set cmd = Nothing

SQL Injection

旁注：

此信息不难发现ASPUpload Answer to SQL insert into database with apostrophe和Object Reference非常好。事实上，如果你看过Online User Manual，你就可以得到问题的答案而不在这里发帖。

个人经验告诉我，在处理第三方COM组件9/10次时，支持文档非常好，特别是在Section 2.2 - FILES and FORM Collections组件的情况下。

如何上传文件并同时将语句插入数据库

1 个答案: