views:

132

answers:

1

Here's my code:

if Request.Form("authorize") <> "" and request.form("delete") <> "true" then
    post_ids = Request.form("authorize")
    ids = split(post_ids, ",")

    For i = LBound(ids) to UBound(ids)
        sql = "update tbl_comments set authorized = 'true' where comment_id = " & ids(i)
        pageDB.execute(sql)
    Next

    message = "<div id=""succeed""><strong>Updated</strong>: Your comments have been approved.</div>"
end if

Instead of just setting "message" to the success message i'd like to do something along the lines of...

if(pageDB.execute(sql) was succesful) then
    message = "<div id=""succeed""><strong>Updated</strong>: Your comments have been approved.</div>"
else 
    message = "<div id=""error""><strong>Error</strong>: Your comments have not been approved.</div>"
end if
+1  A: 

You need to put your pageDB.execute(sql) within a try catch block

Something like this

message = "<div id=""succeed""><strong>Updated</strong>: Your comments have been approved.</div>"
Try
   pageDB.execute(sql)
Catch ex as Exception
   message = "<div id=""error""><strong>Error</strong>: Your comments have not been approved.</div>"
End Try

As the comment under your question suggests though, you should NOT update a SQL database like this as you exposing your database to hacking (very easy hacking)

Consider instead using command parameters. Lots of stuff on the net about this.

Edit

Now that we're talking about classic ASP error handling isn't as easy but still possible. Its a bigger subject so I'd recommend having a look at this article.

http://www.15seconds.com/issue/990603.htm

What type of object is pageDB?

CResults
Thanks for the code, you've got a fair point - is there an ASP equivalent of PHP's mysql_real_escape_string? Also: this is part of a CMS so the public won't have access.
Sam
AH, i've just realised I'm using ASP classic, so I don't think I can use Try Catch blocks.
Sam
@Sam: I've just written a complete answer for ASP classic, including parameterized prepared SQL statements and everything, before I realized that you had tagged your question "vb.net" (even though your code did not look like it). So I threw my answer away. How on earth did you manage to overlook that you are not on .NET?
Tomalak