將JavaScript循環添加到SQL數據庫

Question

我想要實現的是將JavaScript循環和命名變量添加到一個SQL數據庫中，其中一些已經添加到外部腳本，所以工作正常，但是一些我已經在底部的SQL腳本仍然需要添加，但是由於數據庫不接受冒號「：」，他們不會輸入它，並返回一個錯誤，用替換函數查看底部的代碼，確保你可以看到什麼我正在努力實現，但失敗悲慘，非常感謝幫助！

window.status = 'Loading contingency scripts - please wait...'; 
audit('Loading contingency scripts'); 
var conting = { 
    i: 0, 
    start: function() { 
     window.status = 'Loading form - please wait...'; 
     var t = ''; 
     t += '<form name="frm_conting" id="frm_conting" onsubmit="return false;">'; 
     t += '<table width="100%" cellspacing="1" cellpadding="0">'; 
     t += '<tr><td>Date (DD/MM/YY):</td><td><input type="text" size="8" value="' + current_date + '" id="date"></td></tr>'; 

     t += '<tr><td>Time Started:</td><td><select id="timefrom"><option></option>'; 
     for (h = 8; h < 23; h++) { 
      for (m = 0; m < 46; m = m + 15) { 
       t += '<option value=' + nb[h] + ':' + nb[m] + '>' + nb[h] + ':' + nb[m] + '</option>'; 
      }; 
     }; 
     t += '</select></td></tr>'; 

     t += '<tr><td>Time Finished:</td><td><select id="timeto"><option></option>'; 
     for (h = 8; h < 23; h++) { 
      for (m = 0; m < 46; m = m + 15) { 
       t += '<option value=' + nb[h] + ':' + nb[m] + '>' + nb[h] + ':' + nb[m] + '</option>'; 
      }; 
     }; 

     t += '</select><tr><td>Extension #:</td><td><input type="text" size="5" value="' + my.extension + '" id="staffid"></td></tr>'; 
     t += '<tr><td>Desk ID:</td><td><input type="text" size="5" value=' + my.deskid + ' id="desk"></td></tr>'; 
     t += '<tr><td>Number of calls:</td><td><input type="text" size="5" id="calls"></td></tr>'; 
     t += '<tr><td>Avid ID:</td><td><input type="text" size="5" id="avid"></td></tr>'; 
     t += '<tr><td><input type="button" value="Submit" onClick="conting.save()"></td>'; 
     t += '</table>'; 
     t += '</form>'; 

     div_form.innerHTML = t; 
     window.resizeTo(400, 385); 
     window.status = ''; 
    }, 

    save: function() { 
     var conting_date = frm_conting.date.value; 
     if (!isdate(conting_date)) { 
      alert("You have entered an incorrect date."); 
      return false; 
     }; 

     var conting_timefrom = frm_conting.timefrom.value; 
     var conting_timeto = frm_conting.timeto.value; 
     if (conting_timefrom == '' || conting_timeto == '') { 
      alert("You need to enter a starting & finishing time."); 
      return false; 
     }; 
     if (conting_timefrom > conting_timeto) { 
      alert("The time you have entered is after the finish time."); 
      return false; 
     }; 

     var conting_staffid = frm_conting.staffid.value; 
     if (conting_staffid.length != 5) { 
      alert("You have entered an incorrect extension number."); 
      return false; 
     }; 

     var conting_desk = frm_conting.desk.value; 
     if (conting_desk.length != 5) { 
      alert("You have entered an incorrect desk ID."); 
      return false; 
     }; 

     var conting_calls = frm_conting.calls.value; 
     if (isNaN(conting_calls)) { 
      alert("You have not entered amount of calls."); 
      return false; 
     }; 

     var conting_avid = frm_conting.avid.value; 
     if (isNaN(conting_avid)) { 
      alert("You have entered an incorrect avid ID."); 
      return false; 
     }; 
     if (conting_avid.length != 5) { 
      alert("You have entered an incorrect avid ID."); 
      return false; 
     }; 

     conn.open(db["contingency"]); 
     rs.open("SELECT MAX(prac_id) FROM practice", conn); 
     var prac_id = rs.fields(0).value + 1; 
     var prac_timefrom = parseFloat(frm_conting.timefrom.value); 
     var prac_timeto = parseFloat(frm_conting.timefrom.value); 
     var prac_calls = frm_conting.calls.value; 
     var prac_avid = frm_conting.avid.value; 
     rs.close(); 
     var q = "INSERT INTO practice (prac_id, prac_staffid, prac_date, prac_timefrom, prac_timeto, prac_extension, prac_desk, prac_calls, prac_avid) VALUES (" + prac_id + "," + my.id + ", " + current_date + ", " + prac_timefrom + ", " + prac_timeto + ", " + my.extension + ", " + my.deskid + ", " + prac_calls + ", " + prac_avid + ")"; 
     var q = "UPDATE SELECT practice REPLACE ('isNaN', ':', 'isNull')" 

     alert(prac_timefrom); 
     rs.open(q, conn); 
     conn.close(); 
    } 


}; 
window.status = '';​ 

Answer 1

這段代碼看起來非常可疑。

var q = "INSERT INTO practice (prac_id, prac_staffid, prac_date, prac_timefrom, prac_timeto, prac_extension, prac_desk, prac_calls, prac_avid) VALUES (" + prac_id + "," + my.id + ", " + current_date + ", " + prac_timefrom + ", " + prac_timeto + ", " + my.extension + ", " + my.deskid + ", " + prac_calls + ", " + prac_avid + ")"; 
var q = "UPDATE SELECT practice REPLACE ('isNaN', ':', 'isNull')" 

alert(prac_timefrom); 
rs.open(q, conn); 

1. 你應該使用參數化查詢，以避免SQL注入。此外，即使沒有任何有意的SQL注入嘗試，如果任何表單域包含'字符，此代碼將失敗。

2. 您正在爲變量q分配兩次並且未執行第一個賦值的結果。 （並宣佈它實際上是兩次？！）

3. 沒有語法如UPDATE SELECT這將需要像UPDATE practice SET SomeColumn = REPLACE (SomeColumn, 'isNaN', 'isNull')想必除了看到4和5

4. 我不清楚什麼是替換無論如何，這意味着要做。你給出的3個參數是什麼？

5. 在插入數據庫之前對值進行替換，而不是插入錯誤然後將其更新爲新值，會更好。