以文本方式查看主题

-  Foxtable(狐表)  (http://foxtable.com/bbs/index.asp)
--  专家坐堂  (http://foxtable.com/bbs/list.asp?boardid=2)
----  用了开发版一年,怎么保证数据安全呀。比如现在我在做数据导入  (http://foxtable.com/bbs/dispbbs.asp?boardid=2&id=43941)

--  作者:ysq128
--  发布时间:2013/12/19 11:30:00
--  用了开发版一年,怎么保证数据安全呀。比如现在我在做数据导入

导入代码如下:总感觉数据不安全。是不是真的用不能FOXTABLE做商业开发呀。事务处理不支持。SQL事务处理也没例子弄懂如何结合用。

 

Dim Sum1 As Double = Tables("基本资料").Compute("Count(校验结果)", "校验结果 = false ")
If sum1> 0 Then
    MessageBox.show("当前商品资料有" & sum1 & "条记录没有通过校验!不可以导入系统!")
End If

Dim p As WinForm.ProgressBar = e.Form.Controls("ProgressBar1")
p.Minimum = 0 \'设置最小值
p.Maximum = DataTables("基本资料").DataRows.Count \'设置最大值
p.Value = 0 \'设置当前值

Dim cmd As New SQLCommand
cmd.C
Dim products As Integer
For Each dr As DataRow In DataTables("基本资料").DataRows
    p.Value = p.Value+1
    dr("导入结果")=True
    dr("导入报告")=Nothing
    cmd.CommandText = "Insert Into {xx_product} ([goods],[sn],[name],[full_name],[unit],[weight],[cost],[market_price],[price],[memo],[introduction],[product_category],[brand],[create_date],[modify_date],[month_hits_date],[week_hits_date],[month_sales_date],[week_sales_date],[is_list],[is_marketable],[allocated_stock],[hits],[is_gift],[is_top],[month_hits],[week_hits],[month_sales],[week_sales],[point],[sales],[score],[score_count],[total_score]) Values (\'" & dr("货号") & "\',\'" & dr("条形码") & "\',\'" & dr("名称") & "\',\'" &  dr("全称") & "\',\'" & dr("单位") & "\',\'" & dr("重量")  & "\',\'" & dr("成本价") & "\',\'" & dr("市场价") & "\',\'" & dr("销售价")  & "\',\'" & dr("备注") & "\',\'" & dr("介绍") & "\',\'" & dr("商品分类ID")  & "\',\'" & dr("品牌ID")  & "\',\'" & Date.Now & "\',\'" & Date.Now & "\',\'" & Date.Now & "\',\'" & Date.Now  & "\',\'" & Date.Now  & "\',\'" & Date.Now & "\',1,0,0,0,0,0,0,0,0,0,0,0,0,0,0)"
    cmd.ExecuteScalar
    cmd.CommandText = "Select id From {xx_product} Where sn = \'" & dr("条形码") & "\'"
    products=cmd.ExecuteScalar
    MessageBox.show(products)
    If products > 0 Then \'大于0表示增加成功
        \'如果存在规格1
        If _specification1 IsNot Nothing Then
            cmd.CommandText = "Insert Into {xx_product_specification} ([products],[specifications]) Values (\'" & products & "\',\'" & _specification1 & "\')"
            If cmd.ExecuteNonQuery <> 1 Then \'返回1表示增加成功
                dr("导入结果")=False
                dr("导入报告")=dr("导入报告") & "|插入商品规格1属性名失败"
            End If
            cmd.CommandText = "Insert Into {xx_product_specification_value} ([products],[specification_values]) Values (\'" & products & "\',\'" & dr("规格值1ID") & "\')"
            If cmd.ExecuteNonQuery <> 1 Then \'返回1表示增加成功
                dr("导入结果")=False
                dr("导入报告")=dr("导入报告") & "|插入商品规格1属性值失败"
            End If
        End If
        \'如果存在规格2
        If _specification2 IsNot Nothing Then
            cmd.CommandText = "Insert Into {xx_product_specification} ([products],[specifications]) Values (\'" & products & "\',\'" & _specification2 & "\')"
            If cmd.ExecuteNonQuery <> 1 Then \'返回1表示增加成功
                dr("导入结果")=False
                dr("导入报告")=dr("导入报告") & "|插入商品规格2属性名失败"
            End If
            cmd.CommandText = "Insert Into {xx_product_specification_value} ([products],[specification_values]) Values (\'" & products & "\',\'" & dr("规格值2ID") & "\')"
            If cmd.ExecuteNonQuery <> 1 Then \'返回1表示增加成功
                dr("导入结果")=False
                dr("导入报告")=dr("导入报告") & "|插入商品规格2属性值失败"
            End If
        End If
    Else
        dr("导入结果")=False
        dr("导入报告")=dr("导入报告") & "|插入商品基本资料失败 "
    End If
Next
Dim Sum As Double = Tables("基本资料").Compute("Count(导入结果)", "导入结果 = false ")
If sum> 0 Then
    MessageBox.show("当前商品资料有" & sum & "条记录没有导入成功!")
    Tables("基本资料").Filter = " [导入结果] = false "
    For Each errdr As Row In Tables("基本资料").Rows
        cmd.CommandText = "Select id From {xx_product} Where sn = \'" & errdr("条形码") & "\'"
        products=cmd.ExecuteScalar
        cmd.CommandText = "DELETE FROM {xx_product_specification} WHERE products = \'" & products & "\'"
        cmd.ExecuteNonQuery()
        cmd.CommandText = "DELETE FROM {xx_product_specification_value} WHERE products = \'" & products & "\'"
        cmd.ExecuteNonQuery()
        cmd.CommandText = "DELETE FROM {xx_product} WHERE id = \'" & products & "\'"
        cmd.ExecuteNonQuery()
    Next
Else
    MessageBox.show("校验完成!恭喜您,全部导入成功!")
End If
e.Form.Close

[此贴子已经被作者于2013-12-19 11:35:55编辑过]

--  作者:有点甜
--  发布时间:2013/12/19 21:06:00
--  
 一般,这些东西都不应该写在客户端,而应该写在数据库里,用存储过程来实现。然后在客户端把数据传过去。
--  作者:有点甜
--  发布时间:2013/12/19 21:07:00
--  
 如果实在要做存储过程,只能自己拼了

Dim cmd As new SQLCommand
cmd.Co nectio nName = "xxx"
cmd.CommandText = "Begin Transaction test; update 订单 set 单价 = 999; Commit Transaction test"
\'cmd.CommandText = "Begin Transaction test; update 订单 set 单价 = 999; ROLLBACK Transaction test"

cmd.ExecuteNonQuery


--  作者:包头123
--  发布时间:2013/12/20 8:38:00
--  
看来使用狐表本身的数据库与SQL server的数据库编程区别很大啊。狐表本身的数据库是无法使用存储过程的。