Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 SQL Server 2005 Forums
 Transact-SQL (2005)
 result set by id and date

Author  Topic 

erico
Starting Member

34 Posts

Posted - 2007-04-19 : 13:03:09
The following post is long but needed so you can understand what I'm trying to do. Your patients is appreciated.

I have this project that is (for me) rather challenging. I have an asp page with some sql code that reads data from tables in a database. It is suppose to display show title, date, content of show and just below that guest name, guest description and URL. The problem is I'm not sure exactly how to get the code to work so that I have my page displayed correctly when I test in my browser. Here is an example of what the output should look like in the "center" section of the asp page. There is nav elements on both left and right but they are not the issue.

Show Name
1/9/2007

Report from GeekWorld / Bagels / John Smith

Each year, the GeekWorld expo features...


Guests:
John Doe technology reporter
Don Smith owner, A Better Bagel
Harry Smith renaissance man

Related Links:
'link text here' (as text link: blue with an underline)

I have three tables.

Table One: T_Programs
Table Two: T_ProgramGuests
Table Two: T_ProgramLinks

What is happening when I test it that the only thing being displayed is one guest name and one guest link but no content above it. Here is another very important point to this. I want to display show by date and regardless of the time of day show me the most current show complete with guests, descriptions of guests and links. Maybe this will help also. We've been relying on Includes pages for some time now but want to move off of them. I'm trying to get this to work directly from SQL and bypass dependence on Includes pages.

The includes page builds the asp page which displays the content and so forth. I'm trying to create a CMS solution for one of our departments. Yes I know there are many out there but I've been tasked to create this using Access as the front-end for the users to enter the data (process already in place) and get the backend to work "without" includes so we can display whatever they edit.

For example: what if a person from that department makes an update to a guest name, description and link. After they click the transfer button on the Access form it updates the tables in SQL then the asp page would get built from that. Meaning that they could then do a refresh of their browser and see their changes. This way the webteam no longer has to manually update it for them.

It needs to account for unlimited number of guests and links. Most likely they would never show more then maybe 10 to 15. We currently have links on the side of the main or default.asp page that takes you to a show page but it uses an includes. The URL typically looks like this when you mouseover the link:

http://www.company.org/programs/weekday.asp

We're wanting to see something like:
http://www.company.org/programs/defaultweekday.asp

I was recently given and idea from an intern to try and use a -1 or dash one in the asp code to account for the most current days show regardless of time of day. I dont fully understand it's meaning. Something like this: set a variable to -1 then SQL Select would change at the end to not look for an id but instead look for date.

Add an If statement to cover the -1 variable set to -1 and it checks for the date or date variable. It would then query the database and look for the default entry for Weekday for that day. Here is the only other note I have...

Intitially get date from T_Programs and to get the guests & links maybe add a date column, extract the idea of the story when you get the date query. Then use the id to query the other tables.

I hope this isn't too confusing. I'm trying to provide this forum with as much information as I can so hopefully someone can help me figure this out.

Here is the code from one of the two asp test pages where I'm trying to somehow combine the sql selects to get all this to work. I will seperate the code in two code block sections below.

First code block from defaultprogramtest.asp page:


<!-- BEGINNING OF THE GUESTS AND LINKS SECTION -->

<%
set con = Server.CreateObject("ADODB.Connection")
con.Open "File Name=E:\folder\Company\Company.UDL"
set rs = Server.CreateObject("ADODB.Recordset")

id=request.querystring("id") 'If this line is commented out the page will be blank.
'However you can still append a record number to the end of the URL and display that one.

IF id <> "" then id=id else id="9726" end if 'This line shows the default record of 9726. If this line is commented out the page will ONLY show the default record but will NOT allow you
'to append a different number

strSQL = "SELECT *, T_Programs.ID AS Expr1, T_ProgramGuests.ProgramID AS Expr2, T_ProgramGuests.GuestName AS Expr3, T_ProgramGuests.GuestDescription AS Expr4, T_ProgramLinks.URL AS Expr5, T_ProgramLinks.Description AS Expr6 FROM T_ProgramGuests CROSS JOIN T_Programs CROSS JOIN T_ProgramLinks WHERE (T_ProgramGuests.ProgramID = '" & id & "')"

rs.Open strSQL,con 'open a connection to the database

%>

<br />
<strong><% Response.Write RS ("GuestName") %> </strong> <% Response.Write RS("GuestDescription") %><br /><br />
Related Links:<br />
<li class='basic'><A HREF="<%= RS("URL") %>"><%= RS("Description") %></A></li>


<!-- END OF THE GUESTS AND LINKS SECTION -->

<%
recProgram.Close
con.Close
set recProgram = nothing
set con = nothing
'response.write err.Description
<%


Second code block from defaultweekdaytest.asp. All the code above this section is the same as the page above. I just didn't want to repeat it. What is different is the sql select section:


<!-- BEGINNING OF THE GUESTS AND LINKS SECTION -->

<%
set con = Server.CreateObject("ADODB.Connection")
con.Open "File Name=E:\webservice\Company\Company.UDL"
set rs = Server.CreateObject("ADODB.Recordset")

id=request.querystring("id") 'If this line is commented out the page will be blank.
'However you can still append a record number to the end of the URL and display that one.

IF id <> "" then id=id else id="9726" end if 'This line shows the default record of 9726. If this line is commented out the page will ONLY show the default record but will NOT allow you
'to append a different number

strSQL = "SELECT *, Air_Date AS Expr1, Unit AS Expr2 FROM TestTable WHERE (Air_Date = CONVERT(varchar(10), GETDATE(), 101)) AND (Unit = 'TB')"

rs.Open strSQL,con 'open a connection to the database

%>

<br />
<strong><% Response.Write RS ("GuestName") %> </strong> <% Response.Write RS("GuestDescription") %><br /><br />
Related Links:<br />
<li class='basic'><A HREF="<%= RS("URL") %>"><%= RS("Description") %></A></li>


<!-- END OF THE GUESTS AND LINKS SECTION -->


Let me know if you need more information or if I have confused you too much for you to help me. I've never done anything like this before. This type of project is over my head until I learn this stuff better. So any code assistance is greatly appreciated.

Vinnie881
Master Smack Fu Yak Hacker

1231 Posts

Posted - 2007-04-19 : 13:43:50
Honestly I only read through the first pararagraph, so my sugestion may be way off (Your post is very long).

It appears that a Program is also known as a show, is this correct?

If so and the only issue is that you are trying to retrieve the data in the way you mentioned, you would need to do the following.

There are a few differant methods to achieving what you illustrated. I normally Like to return the individual tables or ceate a dataset to contain each table.

So I would run 3 queries (NOT 1 like you have).

This will allow you to properly create your page (Note you can do it with 1, but the way you are attempting to is incorrect)

tbl1 = Select * from T_Programs a
where a.ID = @ID

tb2 = Select * from T_ProgramGuests
where a.ID = @ID
tb3 = Select * from T_ProgramLinks
where A.id = @ID

Once you have that information then just use it to create your table

dim dr as datarow
for each dr in tb1.rows
'This is where you would add your code to add the show
'You would get the field info by using dr("fieldname")
next

for each dr in tb2.rows
'This is where you would add your code to add the Guests
'You would get the field info by using dr("fieldname")
next

for each dr in tb3.rows
'This is where you would add your code to add the Links
'You would get the field info by using dr("fieldname")
next


I am not sure if this is what you are asking. Also this question is not really a t-sql question and should've been in another forum.

Please keep your questions short and to the point. This wil help us resolve your issue quicker.

thanks
Go to Top of Page

erico
Starting Member

34 Posts

Posted - 2007-04-19 : 13:56:46
Yes a program is also a show
Go to Top of Page

erico
Starting Member

34 Posts

Posted - 2007-04-19 : 13:59:35
The reason it's long is because "based on my personal experience with forums" is that if you make it short someone will say there wasn't enough information. Ok then which forum should it posted in?
Go to Top of Page

erico
Starting Member

34 Posts

Posted - 2007-04-19 : 14:08:26
Still working on your suggestion but I did an initial test and this is what I got:

Microsoft VBScript compilation error '800a03ea'

Syntax error

/test/defaultweekday6.asp, line 210

tbl1 = Select * from T_Programs a
-------^
Go to Top of Page

Vinnie881
Master Smack Fu Yak Hacker

1231 Posts

Posted - 2007-04-19 : 14:18:36
The code I posted wasn't a literal translation, it was just to illustrate the methodology.

Also there is a forum specificly for ASP.net on here.

Unfortantly all my programming has been done with either c# or vb.net using a seperate code page, so the syntex is slightly differant.

Hope this helps.
Go to Top of Page

erico
Starting Member

34 Posts

Posted - 2007-04-19 : 14:22:31
Oh I see asp.net. Sorry didn't mean to post in the wrong forum. Yeah I didn't think it should be taken literally. But thanks for getting started. So will I get in trouble if I post this on this website but in the asp.net forum?
Go to Top of Page

Vinnie881
Master Smack Fu Yak Hacker

1231 Posts

Posted - 2007-04-19 : 14:53:23
I would keep it in here, a admin can move it if they choose to.

More people seem to read this forum anyway.
Go to Top of Page

erico
Starting Member

34 Posts

Posted - 2007-04-19 : 17:55:35
Ok I've been trying to find definitions for errors and to understand how to fix this code to make it show the correct information. However I'm still trying to find answers online. Based on my code below could you suggest some web addresses that could help me figure out what I'm missing in my code?


<!-- BEGINNING OF THE GUESTS AND LINKS SECTION -->

<%
set con = Server.CreateObject("ADODB.Connection")
con.Open "File Name=E:\webservice\company\company.UDL"
set rs = Server.CreateObject("ADODB.Recordset")

id=request.querystring("id") 'If this line is commented out the page will be blank.
'However you can still append a record number to the end of the URL and display that one.

IF id <> "" then id=id else id="9726" end if 'This line shows the default record of 9726. If this line is commented out the page will ONLY show the default record but will NOT allow you
'to append a different number

tbl1 = Select * from T_Programs
where a.ID = @ID CASE ID
tb2 = Select * from T_ProgramGuests
where a.ID = @ID
tb3 = Select * from T_ProgramLinks
where A.id = @ID

'strSQL = "SELECT *, Air_Date AS Expr1, Unit AS Expr2 FROM TestTable WHERE (Air_Date = CONVERT(varchar(10), GETDATE(), 101)) AND (Unit = 'TB')"

rs.Open strSQL,con 'open a connection to the database

%>

<%
dim dr as datarow
for each dr in tb1.rows
dr("ID")
'This is where you would add your code to add the show
'You would get the field info by using dr("fieldname")
next

for each dr in tbl2.rows
dr("GuestName")
'This is where you would add your code to add the Guests
'You would get the field info by using dr("fieldname")
next

for each dr in tbl3.rows
dr("URL")
'This is where you would add your code to add the Links
'You would get the field info by using dr("fieldname")
next

<br />
<strong><% Response.Write RS ("GuestName") %> </strong> <% Response.Write RS("GuestDescription") %><br /><br />
Related Links:<br />
<li class='basic'><A HREF="<%= RS("URL") %>"><%= RS("Description") %></A></li>


<!-- END OF THE GUESTS AND LINKS SECTION -->


I'm trying to find answers for this message:

Syntax error

/test/defaultweekday6.asp, line 210

tb1 = Select * from T_Programs a
------^

I'm sure there isn't much more I need to add or modify to get this code working. Any suggestions?
Go to Top of Page

LoztInSpace
Aged Yak Warrior

940 Posts

Posted - 2007-04-19 : 23:01:06
You've got a nice SQL injection potential there. You must use parameters on your query not :

blah blah ....ProgramGuests.ProgramID = '" & id & "')"

Doesn't help your problem but you should be aware of it before someone trashes your database.

Go to Top of Page

erico
Starting Member

34 Posts

Posted - 2007-04-20 : 11:28:10
Thanks Lotz but that doesn't tell me anything. I need parameters. Great which type? SQL injections are over my head until I understand how to code better and can grasp what injections are all about.

Can you suggest some websites that would explain this in simple terms? I am very familure with W3C but there stuff is too general and not specific enough to fit what I'm trying to do.
Go to Top of Page

erico
Starting Member

34 Posts

Posted - 2007-04-20 : 11:54:17
Ok I found a website that explains injections pretty well. I'm beginning to grasp how real the changes are. However I still have to get this asp page to work. The ID thing is not just bad coding on my part. It's a requirement from my manager. I'm not asking you to write out the solution for me but if you could provide me some hints or a website that has examples that at least closely relate to what I'm doing, that would be very helpful.

Thanks again for helping me realize the security risk.
Go to Top of Page

erico
Starting Member

34 Posts

Posted - 2007-04-20 : 11:55:52
I forgot to put this URL in my last quick reply. This is where I found information about injections.

http://www.securiteam.com/securityreviews/5DP0N1P76E.html
Go to Top of Page
   

- Advertisement -