Justin Doh wrote:
Quote:
Hi Bob,
>
I appreciate for your feedback.
>
I am not sure how I could modify the Do While Loop..
Do you have any suggestions?
I know I am only getting two values, but doesn't it have to go
through the end of file?
|
No. If you are only getting two records, you don't even need a loop.
With rsHBSBPOOrder
.ConnectionString = ConnHBS
.Load(strSQL)
Dim nTmp
If not .EOF Then
'recordset is automatically pointing at first record
If Len(nBPO1Val) <0 Then
nBPO1Val = FormatCurrency(nBPO1Val, 0)
End If
nTmp = nBPO1Val
dtBPO1 = Trim(.Fields("dtReceived")&"")
.MoveNext
If not .EOF Then
'recordset is now pointing at second record
nBPO2Val = Trim(.Fields("curBPOAsIs")&"")
If Len(nBPO2Val) = 0 Then
nBPO2Val = nTmp
Else
nBPO2Val = FormatCurrency(nBPO2Val, 0)
End If
dtBPO2 = Trim(.Fields("dtReceived")&"")
End If
End If
..Close '<---
End With
Set rsHWABPOOrder = Nothing
<--- I added the .Close statement, but I recognize I may not have had
to. Does your clsRecordSet class have a Terminate event in which the
recordset and connection are closed? I do hope you are explicitly
closing the database connection ...
Quote:
>
Regards to your second feedback, I am not sure what you meant. Quote:
>You don't show where the value contained in nAcctNum comes from, but
>you are aware that using this technique to execute a procedure
>leaves you vulnerable to sql injection, don't you?
| >
>
|
See what happens if nAcctNum contains something like
1234;create table test (testcol int);
Read about sql injection in these links:
http://www.sqlsecurity.com/DesktopDefault.aspx?tabid=23 http://www.nextgenss.com/papers/adva..._injection.pdf http://www.nextgenss.com/papers/more..._injection.pdf http://www.spidynamics.com/papers/SQ...WhitePaper.pdf
--
Microsoft MVP -- ASP/ASP.NET
Please reply to the newsgroup. The email account listed in my From
header is my spam trap, so I don't check it very often. You will get a
quicker response by posting to the newsgroup.