<%=Variable1%>

<%
strMode = request.form("mode")
Select Case strMode
  Case "edit"
    doEditSub
  Case "new"
    newInputSub
  Case "delete"
    removeSub
End Select

Sub doEditSub()
  '### put your edit sql here, grabbing the appropriate form values
  '### I usually put the ID of the item in the form input
End Sub
Sub newInputSub()
  '### put your insert sql here, grabbing the appropriate values
End Sub
Sub removeSub()
  '### Put your delete sql here. Its generally a good idea
  '### to put some kind of confirmation barrier
End Sub
%>
Insert forms here

quote:

---

'### put your edit sql here, grabbing the appropriate form values
'### I usually put the ID of the item in the form input

---

Set rsCheckUser = Server.CreateObject("ADODB.Recordset")

	'Initalise the strSQL variable with an SQL statement to query the database
	strSQL = "Select * From Users"
	
	

	'Query the database
	rsCheckUser.Open strSQL, strCon,3,3
			
	'Check if card number don't already exist
	do while not rsCheckUser.EOF
		if rsCheckUser("U_ID")=UserID then
			set rsCheckUser=nothing
			set strcon=nothing
			Response.Redirect("already.asp?UserId=" & UserID & "&u_address=" & U_Address & "&u_city=" & U_City & "&u_phone=" & U_Phone & "&u_fax=" & U_Fax & "&newsletter=" & email_subscribe & "&access=" & access & "&first_name=" & first_name & "&last_name=" & last_name &"&Birth_Year=" & Birth_Year & "&sex=" & sex & "&e_mail=" & e_mail & "&Category=" & Category & "&www=" & www & "&Sec_Ans=" & Encrypt(Sec_ans, "nanosoft") & "&xor=" & Encrypt(Password, "nanosoft") & "&Country=" & Country & "&State=" & state & "&E_Mail_Pro=" & E_Mail_Pro & "&Zip=" & Zip & "&xor2=" & Encrypt(Password2, "nanosoft") & "&key_con=" & key_con & "&key_ent=" & key_ent & "&PhotoURL=" & PhotoURL &"&Sec_ques=" & Sec_ques & "&idkey=" & Key_ent &"&token=" & Request.Form("token") & "&cryptKey=" & Request.Form("cryptKey") & "")
		end if
		rsCheckUser.MoveNext
	loop
		
		code = UserID+RandomPW(10)
	'Add a record
	rsCheckUser.AddNew 
	'Put username and password in record
	rsCheckUser("U_ID")=formatSQLInput(UserID)
	rsCheckUser("U_FIRST")=first_name
	rsCheckUser("U_LAST")=last_name
	rsCheckUser("U_SEX")=sex
	rsCheckUser("Birth_Year")=Birth_Year
	rsCheckUser("U_EMAIL")=e_mail
	rsCheckUser("Category")=Category
	rsCheckUser("PhotoURL")=PhotoURL
	rsCheckUser("www")=www
	rsCheckUser("U_Password")=objMD5.HEXMD5
	rsCheckUser("Sec_Ans")=Sec_ans
	rsCheckUser("U_Country")=Country
	rsCheckUser("U_State")=State
	rsCheckUser("E_Mail_Pro")=E_Mail_Pro
	rsCheckUser("U_Zip")=Zip
	rsCheckUser("Date_join") = Now()
	rsCheckUser("Activation_Code") = code
	rsCheckUser("Sec_ques") = Sec_ques
	rsCheckUser("u_address") = u_address
	rsCheckUser("u_city") = u_city
	rsCheckUser("u_phone") = u_phone
	rsCheckUser("u_fax") = u_fax
	rsCheckUser("email_subscribe") = newsletter
	rsCheckUser("access") = access
	rsCheckUser("Remote_IP") = Request.Servervariables("REMOTE_ADDR")


	
	'Save record
	rsCheckUser.Update 
	
	set rsCheckUser=nothing
	set strcon=nothing

quote:

---

Originally posted by Astralis

Forms? Why would there be more than one, if that's what you meant.?

---

quote:

---

Originally posted by Astralis

quote:

---

'### put your edit sql here, grabbing the appropriate form values
'### I usually put the ID of the item in the form input

---

How to prevent someone from editing a different row by changing the id in the querystring?

---

quote:

---

Originally posted by Astralis


This is a sample Insert SQL. The problem I have with it is that it's calling all rows in the SQL which isn't necessary. What do you think of this insert method? How would you change it?

---