Loading another page within via onClick

[Bik]

I'm building a list of customer orders via ASP/VBscript. e.g:
51 John Doe $1,201.50
52 Jane Smith $ 500.00
53 Jim Miller $1,250.25

I want order numbers 51, 52, 53 hyperlinked to a function which then
makes a Stored Procedure call to SQL Server, and then loads another
page within the current page. So that my main.asp page still remains,
even though the order number displaying page order.asp is executed.

All SQL stored procedures are run using VBScript, but I never done this
using Javascript. In the past, I'd do an #include, but since I don't
know which order number one my click, I have to get the order number
based on onClick event.

How can I achieve this?

[McKirahan]

"Bik" <bi*****@gmail.com> wrote in message
news:11**********************@o13g2000cwo.googlegr oups.com...

I'm building a list of customer orders via ASP/VBscript. e.g:
51 John Doe $1,201.50
52 Jane Smith $ 500.00
53 Jim Miller $1,250.25

I want order numbers 51, 52, 53 hyperlinked to a function which then
makes a Stored Procedure call to SQL Server, and then loads another
page within the current page. So that my main.asp page still remains,
even though the order number displaying page order.asp is executed.

All SQL stored procedures are run using VBScript, but I never done this
using Javascript. In the past, I'd do an #include, but since I don't
know which order number one my click, I have to get the order number
based on onClick event.

How can I achieve this?

Perhaps an iframe?

http://www.w3schools.com/tags/tag_iframe.asp

The iframe element creates an inline frame that contains another document.

[Bik]

Good to know about iFrame, I did not know, it's a cool feature.
However, 2 things i find may cause an issue with me.

1. Before opening an iFrame, I need to sent a control to a routine
that is run on the server to get data from SQL Server using a stored
proc, hence, I need a way to execute a stored proc. And then only run
the iFrame

2. Suppose I do get information from SQL server, I don't want to pass
it as QueryStrings within iFrame. Someone can lookup the source, and
figure out QueryStrings, and may compromise the security of my
database, another words, someone may snoop live data.

[Tim Williams]

Only a half-witted would-be snooper would be stymied just by avoiding
querystrings. Whatever method you use will expose pretty much the
same information on the client page. It's dead simple to view the
source and see field names whether you're using GET or POST. If data
needs to be secure then it should be password-protected. If this is
done and it's still possible to see data you shouldn't be seeing then
you should re-think your approach.

Why do you need to run a stored procedure before populating the
iframe? Are you looking up information you need to create the iframe
content? - you could just include that in the script generating the
order details....

Tim.

"Bik" <bi*****@gmail.com> wrote in message
news:11*********************@o13g2000cwo.googlegro ups.com...

Good to know about iFrame, I did not know, it's a cool feature.
However, 2 things i find may cause an issue with me.

1. Before opening an iFrame, I need to sent a control to a routine
that is run on the server to get data from SQL Server using a stored
proc, hence, I need a way to execute a stored proc. And then only
run
the iFrame

2. Suppose I do get information from SQL server, I don't want to
pass
it as QueryStrings within iFrame. Someone can lookup the source,
and
figure out QueryStrings, and may compromise the security of my
database, another words, someone may snoop live data.

[Bik]

I agree with you. I think I am going to re-evaluate my approach,
storing login session state, so that even someone does go into the
history and pull out the url with QueryString, at least session will
determine that this person has not yet logged in, hence provide login
page.

Secondly, yes, I am looking up information particular to an item which
is hyperlinked. I supply one piece of information, then populate 4 or
5 Session variables, then my #Include file use these session vars to
display.
e.g. suppose hyperlinked item is Order #, say 1020. Once you click on
the hyperlink, supposed to in theory take the Order No supply it to a
VBScript runs Store Proc on the server, and pulls out information and
populates Session Variables with, say CustomerID=153, ShippingID=44,
and couple of more. The the control flows to #include file=xxx.asp to
render it