New Recordset Code in CS3?

Question

I have some ASP (VBScript) pages where I use a "sort"
feature. The idea is
that when a user clicks on a column heading, this value
becomes a string in
the address bar. Then, I setup the recordset to ORDER BY
varsort (where
varsort = request.querystring("sort")).
In previous versions of DW this worked fine, but not with
CS3. The code for
the recordsets created with CS3 appears to be different. Why
would the new
code "break" my setup (it's not recognizing any sorts)?
Sort page with old DW:
http://www.presentationsdirect.com/Laminators/search_results.asp?lamtype=pouch
Sort page with new DW:
http://www.presentationsdirect.com/Laminators/Supplies/search_results_rolls.asp?width=25
Brandon
http://www.presentationsdirect.com

Answer 1

Thanks for the helpful info.
Brandon
"danilocelic AdobeCommunityExpert"
<[email protected]> wrote in
message news:f7ll5h$1u9$[email protected]..
> Nancy - Adobe Comm. Expert wrote:
>> The code for
>>> the recordsets created with CS3 appears to be
different. Why would the
>>> new code "break" my setup (it's not recognizing
any sorts)?
>>
>>
>> Recordset code was not updated in CS3, but rather in
8.02 to deter SQL
>> injection attacks. Quickly remake the recordset with
the new version and
>> you should be good to go.
>
> Nancy,
>
> Unfortunately, what the OP is asking for isn't possible
with the "new
> version" of recordset, as it assumes that all parameters
within the SQL
> are column value parameters, and dynamic SQL generation
is no longer
> supported. This has caused a number of folks )including
Tom Muck quite
> vociferously) to complain about the lack of versatility
of the new
> recordset code.
>
>
>
> Brandon, What you'll need to do is to hand edit the
recordset after you've
> applied it to the page. I've not tried this particular
use case recently,
> but it is possible that after editing that DW will no
longer recognize
> that the recordset is on the page.
>
> FWIW: You should never directly use a querystring
parameter in your code,
> you should always "clean" it first. IIRC The old style
of recordsets did a
> replace on the value replacing all single quotes with
doubled single
> quotes. A better way may be to have some code that
checks for the value of
> the querystring parameter and if it matches one of your
column you can
> sort on, then use a string of your own making to use
within the SQL.
>
>
> --
> Danilo Celic
> | Extending Knowledge Daily :
http://CommunityMX.com/
> | Adobe Community Expert