Member Avatar for wchitamb

I do need some help I am building up an asp application that will access an SQL server [database] so what I want is for the admin access to add, update and delete in all the tables

I have about 13 different tables so my questions is do I have to do separate add.asp update.asp and delete.asp for all the different tables or I can have just one and do the include as like the one for database connection I am a baby in ASP so I really need some help.

  • 1 Contributor
  • 1 Reply
  • 259 Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by wchitamb

Dani AI

Generated

A single admin page can work, and it is a good idea for maintainability — but do it as a small, well-structured framework rather than one giant set of if/then blocks. As suggested, a table selector + one handler is doable; the important improvements are (1) never build SQL by concatenating raw request values, (2) enforce a server-side whitelist of allowed tables/fields, and (3) keep DB access, validation and SQL generation in reusable include files.

Suggested, practical architecture and workflow:

  • Keep a single DB include (dbConn.asp) and a single CRUD include (crud.inc.asp) with functions for parameterized INSERT/UPDATE/DELETE.
  • Maintain a metadata map (in code or a small admin table) that lists each table, its editable fields, data types and the primary key. Use that metadata to render the admin form dynamically and to validate inputs server-side.
  • The admin form posts the chosen table and field values to a generic handler (e.g. adminCrud.asp?action=insert&table=Customers). The handler checks the table name against the metadata whitelist, validates each field, then executes a stored procedure or a parameterized ADODB.Command built from the metadata.

Minimal example (concept only — adapt types and error handling):

' metadata: table => editable fields
Dim meta: meta = Server.CreateObject("Scripting.Dictionary")
meta.Add "Customers", Array("Name","Email","Phone")
' in handler:
tbl = Request.Form("table")
If Not meta.Exists(tbl) Then Response.End
fields = meta(tbl)
' build ADODB.Command or call stored proc; add parameters for each field safely

Cautions and tips:

  • Use stored procedures or ADODB.Command with parameters to prevent SQL injection.
  • Whitelist table names and allowed fields; never accept arbitrary table names.
  • Implement server-side validation, transactions for multi-row ops, error logging, and admin authentication.
  • If you prefer simplicity at first, create per-table pages but keep DB logic in includes so refactoring later is easy.

This gives a single UI while keeping code safe, testable and maintainable.

Member Avatar for wchitamb

solution tho no idea yet how to implement it

So i just want to create create one page , on that page with my text boxes make one combo box and put all my database table names in this combo box.Before adding the data First select my table name from combo box then click on add . In my code pass querystring for every table different i.e pass 1,2,3... like this then retrieve querystring using

a=request.querystring(----your variable in combo option---)

then make the connection with my database and put my insert statement in one variable for every table then put the if condition and write if (value come from querystring is 1 then execute my first variable in which there is the insert statement of first table else if (value come from querystring is 2 then execute my second variable in which there is the insert statement of sec. table. then do same thing for update and del button.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.