work fine—they enable you to take user data from a form and perform some action on your database. But as your knowledge of ColdFusion grows and your applications become more sophisticated, you might find that you need more flexibility in working with your database. Take a look at Figure 7.16 for a basic example. FIGURE 7.16 A basic input form that collects data from the user.
To input this data into a table, you’d use an action page like Listing 7.10. LISTING 7.10 1: 2: 3: 4: 5: 6: 7: 8: 9: 10:
guestbook_submit.cfm
DATASOURCE=”gargantuan” TABLENAME=”visitors” FORMFIELDS=”name,email,net_worth”>
<TITLE>Thanks For Submitting Your Entry
Changing the Contents of a Database with ColdFusion
LISTING 7.10 11: 12: 13: 14: 15: 16: 17: 18: 19: 20: 21: 22: 23:
159
continued
Thanks For Submitting Your Entry
The text you entered reads as follows: Your name: #form.name# Your e-mail address: #form.email#
Your net worth: #form.net_worth#
Note
The prefix “form.” used on lines 16–18 in Listing 7.10 is called a scope. You’ll learn more about scoping your variables on Day 9, “Enhancing Your Applications with Variables and Program Flow,” but for now just know that using this prefix is a way of telling ColdFusion that you’re referring to variables that have been sent by a form.
is a great tool if you want to work just with form data, but what if you have other information that you’d like to insert—information that doesn’t come from the form? To illustrate, let’s say that you want to input the current time and date at the moment the user’s information is added to the database. You could use a special ColdFusion function called Now() on your action page to generate the current time and date, but because that value isn’t being passed by the form, won’t “see” it. The tag only enables you to list form fields to insert, so clearly that won’t work.
Note
ColdFusion functions are covered in detail on Day 9. For now, just know that #Now()# creates a variable that holds the current time and date reported by your Web server.
In situations like these in which you need to input data that doesn’t come directly from a form, you can use alternative methods to add or edit your database contents. These methods are the SQL commands UPDATE, INSERT, and DELETE. All are used in the context of a standard SQL query in place of the now-familiar SELECT command. The next sections examine all three commands in detail, but first consider a few situations in which you’d want to use these SQL methods instead of their simpler ColdFusion equivalents:
7
160
Day 7
• When you need to insert data that isn’t passed from a form • When you need to insert data into more than one table • When your insert or update an action that is generally too complex to be handled with or • When you need to delete a record or records from a table
Using SQL’s INSERT Command To see how to insert data with SQL, start with the following example. The action page in Listing 7.10 contained an insert function like this:
DATASOURCE=”gargantuan” TABLENAME=”visitors” FORMFIELDS=”name,email,net_worth”>
But, now you’d like to insert the current date/time into the database, and the form hasn’t passed that information. You might replace the previous statement with an SQL query like this: INSERT INTO visitors(name,email,net_worth,date) VALUES(‘#name#’, ‘#email#’, ‘#net_worth#’, #Now()#)
An SQL insert like this is much more flexible than because it gives you more control over what—and where—data is inserted.
Note
SQL INSERTs and UPDATEs require that you know the data types of columns in your database. For example, inserting text into a column defined as the text data type requires single quotes around the inserted string. A number inserted into a column defined as a numeric data type does not. If you forget the single quotes or add them unnecessarily, ColdFusion will warn you with an error.
Take a closer look at the statement. It begins with a standard tag, although no NAME is used because this query won’t be outputting any data. It specifies the name of a table to INSERT INTO and follows with a comma-delimited list of column names in parentheses. The order of these is important because it must correspond exactly to the order of the data listed in VALUES.
Changing the Contents of a Database with ColdFusion
161
The final value of INSERT, #Now()#, places the current date and time reported by the Web server into the visitors table at the moment the user inputs the form. This special function isn’t surrounded by single quotes because it isn’t a text string—it’s actually something called a date/time object, but you’ll learn more about that in Day 14. Assuming a user inputs typical data into the form, my Microsoft Access database now contains a record like Figure 7.17. Note that the ID column is automatically supplied by Access as each new record enters the table. FIGURE 7.17 A record inserted with SQL’s INSERT command, containing the date and time of the insertion.
Note
Depending on your database software and the data type in your table, date/time objects such as Now() might require special formatting before your database will accept them in an INSERT action. If you have trouble with the INSERT described earlier, try using text data types for the examples in today’s lesson. When you learn more about date/time objects in Day 14, you can then use ColdFusion functions to put Now() into a date format accepted by your database.
Using SQL’s UPDATE Command The UPDATE command is similar to INSERT, but it takes a different set of parameters. To illustrate how it is used, suppose that you want to create a page that will enable users to edit erroneous information submitted in the previous example. You’d use a form that
7
162
Day 7
would select the user’s existing record from the database and display it as VALUEs in a form, like Figure 7.18. FIGURE 7.18 A form that lets users edit previously submitted data.
The code that produced this form is shown in Listing 7.11. The page requires an ID variable to be supplied in the URL (or possibly from a previous form) to grab the user’s record. LISTING 7.11
guestbook_edit.cfm
1: 2: SELECT * FROM visitors WHERE ID = #ID# 3: 4: 5: 6: 7: <TITLE>Edit User Information 8: 9: 10: 11: Edit Your User Information
12: 13: To edit your user information, alter the text fields and press ➥ the button below. 14: 15:
Changing the Contents of a Database with ColdFusion
LISTING 7.11 16: 17: 18: 19: 20: 21: 22: 23: 24: 25: 26: 27: 28: 29: 30: 31: 32: 33:
163
continued
Note
Notice that Listing 7.11 includes a “hidden” field on line 26 containing the ID number associated with the record. This is important because it will be required on the action page to perform an update with either or SQL’s UPDATE command.
The form enables users to work with their existing data—correct spelling errors, increase their net worth, whatever—and then resubmit the new information to the database, where it will overwrite their previous records. To accomplish this last task, you might use a tag like this on the action page:
DATASOURCE=”gargantuan” TABLENAME=”visitors” FORMFIELDS=”name,email,net_worth”>
As long as you’re sure to pass ID (the table’s primary key) as a hidden field, will take the user’s edited data from the form and overwrite the record. But let’s say that you want to be a little tricky and overwrite the existing date column with the new date at the time the user submits his edited data. Like in the last section, doesn’t have any provision for updating data not sent by the form. You’ll have to improvise with SQL’s UPDATE command, as illustrated in Listing 7.12, which contains the action page for the form.
7
164
Day 7
LISTING 7.12 1: 2: 3: 4: 5: 6: 7: 8: 9: 10: 11: 12: 13: 14: 15: 16: 17: 18: 19: 20: 21: 22: 23: 24: 25: 26: 27: 28: 29: 30:
guestbook_edit_submit.cfm
UPDATE visitors SET name=’#name#’, email=’#email#’, net_worth=’#net_worth#’, visited=#Now()# WHERE ID=#ID#
<TITLE>Thanks For Submitting Your Entry Thanks For Submitting Your Entry
The text you entered reads as follows: Your name: #form.name# Your e-mail address: #form.email#
Your net worth: #form.net_worth#
ANALYSIS Listing 7.12 contains a query that uses SQL’s UPDATE rather than . It
specifies a table to UPDATE, and then lists column names and the variable values that will overwrite the old data. Note that, as in the last section, the #Now()# function isn’t surrounded by single quotes because it is not a simple text string. The UPDATE query ends with the required line WHERE ID=#ID#
This tells ColdFusion exactly which record you want to replace—without it, the update would fail, and you’d see an error message.
Using SQL’s DELETE Command Unlike INSERT and UPDATE, SQL’s DELETE command has no corresponding ColdFusion tag. This means that, when you want to delete data from your tables with ColdFusion, you always have to use the DELETE command in the context of an SQL query.
Changing the Contents of a Database with ColdFusion
165
When you remove a database record or records with DELETE, it’s gone forever. There are no second chances or “wish-I-woulda’s.” Because of this, it’s important to exercise extreme caution in creating pages that enable users to delete information.
Caution
Take a look at a sample delete form in Figure 7.19. FIGURE 7.19 A form designed to delete a user record from the database.
The code that produced Figure 7.19 is shown in Listing 7.13. LISTING 7.13 1: 2: 3: 4: 5: 6: 7: 8: 9: 10: 11: 12:
guestbook_delete.cfm
SELECT * FROM visitors <TITLE>Delete User Information Delete User Information
7
166
Day 7
LISTING 7.13 13: 14: 15: 16: 17: 18: 19: 20: 21: 22: 23: 24: 25: 26: 27: 28: 29: 30: 31: 32: 33: 34:
continued
To delete a user, select the name and press the button below.
It’s a pretty straightforward form page, but there are a few things to note. First, the query section on lines 1–3 gets the data for all users from the visitors table. These are output as OPTION values in the form’s SELECT box on lines 18–26. Note that although the SELECT box will display the user’s name, the variable that will be passed is actually #ID#. Again, this is important because you need to send a unique value to the action page where the actual deletion will occur. The ID number is perfect for this because it ensures that you won’t delete the wrong record.
ANALYSIS
Listing 7.13 passes just one variable to the action page guestbook_delete_action.cfm, the record’s ID. This page is shown in Listing 7.14. LISTING 7.14 1: 2: 3: 4: 5: 6: 7: 8: 9: 10: 11:
guestbook_delete_action.cfm
DELETE FROM visitors WHERE ID=#form.ID#
<TITLE>Entry Deleted
Changing the Contents of a Database with ColdFusion
LISTING 7.14
167
continued
12: 13: 14: Thanks For Submitting Your Entry
15: 16: The record for user ID #form.ID# has been ➥deleted. 17: 18: 19: 20: 21:
SQL’s DELETE command is very simple to use, and therein lies one of its great dangers. It requires only one parameter to work—in this case, the #ID# passed by the previous form. You simply specify a table name to delete from and, flash, the record is gone.
Tip
When building pages that use DELETE, don’t forget that it’s best to use a test table or datasource to test your handiwork. Use an active datasource, and you risk zapping crucial data.
Summary ColdFusion’s interaction with databases goes far beyond simple output. ColdFusion tags such as and give you the ability to create Web-based forms that can change the contents of your database. In doing so, you can allow yourself, your clients, and your users to make instant changes to stuff that appears on your Web sites. Most often, these types of changes are made through Web forms built with standard HTML tags such as