Dreamweaver CS3 SQL code

Question

I have a working application that was created using DW
2004MX. I just upgraded to CS3 and am finding that code blocks
created before are changed by CS3 (if I update some characteristic)
and no longer function. A simple example is a recordset that uses
the SQL "IN" operator with a list of numbers (indexes) passed in a
URL parameter. When I create the recordset, the test function works
fine; however, when the page is operating the page will only
function if there is just one piece of data in the URL. If there is
more than one there is no response. I have attached a simple
example from both 2004 and CS3, I can edit the code to work but I'd
like to understand what's going on. Any ideas would be greatly
appreciated.

Answer 1

HGRMTT wrote:
> I have a working application that was created using DW
2004MX. I just upgraded
> to CS3 and am finding that code blocks created before
are changed by CS3 (if I
> update some characteristic) and no longer function. A
simple example is a
> recordset that uses the SQL "IN" operator with a list of
numbers (indexes)
> passed in a URL parameter. When I create the recordset,
the test function
> works fine; however, when the page is operating the page
will only function if
> there is just one piece of data in the URL. If there is
more than one there is
> no response. I have attached a simple example from both
2004 and CS3, I can
> edit the code to work but I'd like to understand what's
going on. Any ideas
> would be greatly appreciated.
>
> Under 2004 MX
> <%
> Dim rs_donations__MMColParam
> rs_donations__MMColParam = "1"
> If (Request.QueryString("DonationID") <> "") Then
> rs_donations__MMColParam =
Request.QueryString("DonationID")
> End If
> %>
> <%
> Dim rs_donations
> Dim rs_donations_numRows
>
> Set rs_donations =
Server.CreateObject("ADODB.Recordset")
> rs_donations.ActiveConnection = MM_connHGRM_STRING
> rs_donations.Source = "SELECT * FROM Donations WHERE
DonationID IN (" +
> Replace(rs_donations__MMColParam, "'", "''") + ") ORDER
BY LastName, FirstName"
> rs_donations.CursorType = 0
> rs_donations.CursorLocation = 2
> rs_donations.LockType = 1
> rs_donations.Open()
>
> rs_donations_numRows = 0
> %>
>
> Under CS3
> <%
> Dim rs_donations
> Dim rs_donations_cmd
> Dim rs_donations_numRows
>
> Set rs_donations_cmd = Server.CreateObject
("ADODB.Command")
> rs_donations_cmd.ActiveConnection = MM_connHGRM_STRING
> rs_donations_cmd.CommandText = "SELECT * FROM Donations
WHERE DonationID IN ("
> + rs_donations__MMColParam + ")"
> rs_donations_cmd.Prepared = true
> rs_donations_cmd.Parameters.Append
rs_donations_cmd.CreateParameter("param1",
> 5, 1, -1, rs_donations__MMColParam) ' adDouble
>
> Set rs_donations = rs_donations_cmd.Execute
> rs_donations_numRows = 0
> %>
>
When Dreamweaver went to 8.02 there were some major changes
introduced
to recordsets. It prevents the code from being susceptible to
SQL
injection attacks which was a well needed update, but this
means that
all recordsets need to be created from scratch.
See this:
http://kb.adobe.com/selfservice/viewContent.do?externalId=4e6b330a&sliceId=2
Steve