Building a Sorting Query
Written by Eric Smith, Northstar Computer Systems LLC
In many of my tables, I provide the option to sort by a column, as is used in the ASP Techniques Tip Archive. To make this work, I build a SQL statement that adds on a sort field based on the column selected, as shown here:
strSQL = "SELECT * FROM tblTips ORDER BY " & strSortField
Since we're not dealing with a data value, we don't need single quotes around the name of the sort field. You do need to be careful with this type of code, especially if the value for strSortField is coming from a URL. You should be sure to clean the value to prevent potential SQL injection attacks by looking for single quotes and for the dash-dash sequence, which can allow the rest of a statement to be ignored.
Keywords: [
ASP Security
]
Publication Date: 7/14/2000, Last Update: 2/25/2010
|