If you use this code you are leaving yourself wide open to an SQL Injection. Many new virus seek out and attack sites that are vulnerble to SQL Injection and both delete tables and place macious code into database.
What would be better is to pass across a value like 1 for ASC and 2 for DESC like:-
strSQL = "SELECT TOP 10 * FROM dbo.products WHERE category_name='lcd tv' OR
category_name='televisions' OR category_name='plasma tv' ORDER BY display_price "
If Request.Form("SortField") = "1" Then
strSQL = strSQL & " ASC;"
Else
strSQL = strSQL & " DESC;"
End If
<form action="delete2.asp" method="post">
Sort by:
<select name="SortField">
<option value=1>ORDER BY display_price ASC</option>
<option vlaue=2>ORDER BY display_price DESC</option>
</select>
<input type="submit" name="SortButton" value="Select">
</form>
|
Topic Options
Post Options
Thanks(0)
