ADO.Net Use ADO.Net to Populate an ASP.net Website

Example: <tr><td> request (ROW="SuperBowl" Column="TEAM1INFO") </td></tr>

[lukioki]

I'm developing a large website that deals with various national sporting events. I us classic ASP now. I'm migrating to ASP.NET. Because many of my pages are similar and require regular updates on dates, pricing, and info I want them to pull data from an ACCESS database. I do not want to pull a Data Table. I want to request individual row-cell content and use that data to Fill a asp template. For example, <tr><td> request (ROW="SuperBowl" Column="TEAM1INFO") </td></tr>.

Thank you

[TheNige]

Do some research on ASP.Net Repeaters, DataLists, etc.

[lukioki]

Thank you TheNige-

Ok I was able to get the following example code to access the first record where "firstname=Joe" but if I input the second record where "firstname=Bob", the page fails to compile. How do I access any single record?

The Access table assigned to odbc_object looks like:
id ¦ firstname ¦ lastname
---------------------------
1 ¦ Joe ¦ Mills
2 ¦ Bob ¦ Johnston

<%
Dim rs
Set rs = Server.CreateObject ("ADODB.Recordset")
rs.Open "table1", "DSN=odbc_object"

If rs("firstname")="Joe" then
Response.Write "ID: " & rs("id") & "<br>"
Response.Write "First Name: " & rs("firstname") & "<br>"
Response.Write "Last Name: " & rs("lastname") & "<br>"
End If

rs.Close
Set rs = Nothing
%>

[TheNige]

You should really look into the ADO.Net objects instead of using the ADODB.Recordset. Go to www.Asp.Net and look at the quick start tutorials.

You should also look at some SQL tutorials. If you only need one record from your database you would use a select statement like: "SELECT * FROM Table WHERE Name='Bob'"

This would then return just that row for you to work with. If you want your code to work as you posted using ADODB and no SQL query, you'd need to at least put the IF statement in some kind of loop and go through all of the records until you found firstname='Bob'

[TheNige]

Oh yeah, and welcome to WebMasterWorld!

[lukioki]

That was a helpful thread! The following Recordset.Open statement worked:

rs.Open "SELECT * FROM 05schedule WHERE team1=49ers", "DSN=football"

Thank you! There is something else though. Rather than WHERE team1=49ers I want to pass a variable to the statement like WHERE team1=Request("TEAMNAME"). This doesn't work though and declaring a variable first such as teamname=Request(“TEAMNAME”) to set team1 equal to doesn't work either. Any suggestions?

I’ll look into ADO.Net, since I’m familiar with classic ASP I thought this an easier route for starters. Thank you for the welcome!

[TheNige]

simply use concantenation:

rs.Open "SELECT * FROM 05schedule WHERE team1='" & Request("TeamName") & "'", "DSN=football"

[Xoc]

You must always be careful about using concatination to form SQL when the data comes from a web page. It can lead to SQL insertion attacks. What if the team name submitted to the web page was hacked to become

49ers' or 1=1 or team1='49ers

The query would return all the teams, not just the 49ers.

Now, in this case it may not be critical, but you should always be thinking about it. Parameterized queries avoids this problem.

[lukioki]

The concatenation attack isn't a security issue for this particular project so I'll try it. Thank you for the heads up!