0

我在经典 asp 中进行了一个非常简单的搜索查询，它在数据库中查找与用户搜索查询“相似”的单词。

当我搜索“测试”时，我的网页显示没有结果。但是，我有一个标题为 search 的特定帖子，我可以在我的数据库中看到它。

我不确定为什么这不起作用。

<% option explicit %>

<!DOCTYPE HTML>
<html>
<head>
  <link href="normalize.css" rel="stylesheet" type="text/css">
</head>
<body>
<!--#include file="header.asp"-->
<!--#include file="dbconn.asp"-->
<%
  dim stage, s, sql, info
  stage = request.querystring("stage")
  if stage = "" then stage=1



  '------------------------------------------------------------------
  if stage = 1 then
  '------------------------------------------------------------------

    response.write "<form action=""search.asp"" method=""get"">" &_
                   "<input type=""hidden"" name=""stage"" value=""2"">"&_
                   "<input type=""text"" id=""search"" name=""search"">" &_
                   "<input type=""submit"" value=""Search"">" &_
                   "</form>" 


  '------------------------------------------------------------------
  elseif stage = 2 then
  '------------------------------------------------------------------

    '--- grab the data from the form
    dim search
    search = Request.QueryString("search")



    '--- execute the query
    '                0       1            2
     SQL = " select ID, projectName, Description from projectstable"&_ 
            " where (projectName like ' %search% ' or description like ' %search% ')"

    set info=conn.execute(sql)

     if info.eof then
      response.write "    <div class=""box2"">"&chr(13)
      response.write "      Sorry, no records matching your query"&chr(13)
      response.write "    </div>"&chr(13)
    else
      response.write "<div class=""list"">" &_
                     "<table>" &_
                     "<tr>" &_
                     "<th>Title</th><th>Post</th>" &_
                     "</tr>"
      do
        response.write "<tr>" &_
                       "<td>"&info(1)&"</td><td>"&info(2)&"</td>"&_
                       "</tr>"
        info.movenext
      loop until info.eof
      response.write "</table></div>"
    end if

  '------------------------------------------------------------------
  end if  ' stage
  '------------------------------------------------------------------

  response.write "<br clear=""left""><br>"
  if stage=2 then 
    response.write "<i>that's all folks!</i><br><br>"&_
                   "<a href=""search.asp"">Search again</a> | " 

  end if
  response.write "<a href=""./"">back to main page</a>"
  conn.close
%>
</div>
</body>
</html>
4

1 回答 1

2

您的查询需要更改以将搜索变量包含在 sql 字符串中（而不是搜索短语“search”）：

SQL = " select ID, projectName, Description from projectstable"&_ 
      " where (projectName like '%" & search & "%' or description like '%" & search & "%')"

话虽如此，这很容易受到sql注入的影响。使用这种方法时要小心。考虑改用参数化查询。

于 2013-10-09T03:56:01.037 回答