ASP會話值

Question

我在我的代碼中設置了一個MM_CustomerID會話，然後進一步向下翻頁，我需要將該會話的值插入到表中。但每次我嘗試這樣做時，都會出現一個無效的列名「varCustomerID」。

在頁面的頂部我有這段代碼;

<% 
set rscustomerid = Server.CreateObject("ADODB.Recordset") 
rscustomerid.ActiveConnection = CmdAddCustomer.ActiveConnection 
rscustomerid.Source = "SELECT @@IDENTITY as MaxCustomersID FROM Customers" 
rscustomerid.CursorLocation = 2 
rscustomerid.LockType = 3 
rscustomerid.Open() 
Session("MM_CustomerID")=rscustomerid("MaxCustomersID") 
Session("MM_UserAuthorization") = "5" 
%> 

然後進一步向下，我試圖設置varCustomerID的一個變量以等於MM_CustomerID會話;

<% 
varCustomerID = Session("MM_CustomerID") 
%> 

然後嘗試插入該變量varCustomerID的值插入到訂單表如下：

<% 
'Insert record into Orders recordset when form is submitted 
'and store the unique OrderID 
'Version Date: 09 August 2009 
set CmdAddOrder = Server.CreateObject("ADODB.Command") 
CmdAddOrder.ActiveConnection = MM_dbconn_STRING 
CmdAddOrder.CommandText = "INSERT INTO Orders (OrderCustomer,OrderGrandTotal,OrderStatus) VALUES (varCustomerID,0.00,3)" 
CmdAddOrder.CommandType = 1 
CmdAddOrder.CommandTimeout = 0 
CmdAddOrder.Prepared = true 
CmdAddOrder.Execute() 
%> 

我想知道是否有人可以幫忙嗎？也許只是將會話值插入表中，而不是爲它創建一個變量更簡單一些？

謝謝。

Answer 1

你需要投varCustomerID爲查詢字符串。對Paul的回答略有改變應該能讓你工作，但就像他說你需要小心注射攻擊。

"INSERT INTO Orders (OrderCustomer,OrderGrandTotal,OrderStatus) VALUES (" & varCustomerID & ",0.00,3)" 

Answer 2

您需要的SQL命令文本更改爲：

「INSERT INTO訂單（OrderCustomer，OrderGrandTotal，OrderStatus）VALUES（」 + varCustomerID + 「0.00,3）」

但是你可能是容易受到SQL注入......真的是你應該parametrise此查詢：

http://aspnet101.com/aspnet101/tutorials.aspx?id=1