"At manufacturing companies," Brent Railey wrote, "all you ever hear about is SAFETY, SAFETY, SAFETY. In fact, that was exactly the type of application I was tasked with reviewing: an 'Activity Based Safety Program' application for the corporate offices. It was a Classic ASP application that was 'slightly customized' from another application."

"As I was testing out the application, I noticed a little AJAXy behavior. When I selected one category, it would populate another section with the list of items in that category. Not bad for ASP, I figured. That is, until I looked at the code." 

Sub CategoryOnChange()
    categoryValue = window.event.srcElement.value
    document.all("aBehavior").length = 0
    
    ' Add 'Select a Behavior' option
    Dim noneOpt  
    Set noneOpt = document.createElement("OPTION")
    noneOpt.value = 0
    noneOpt.text = "Select a Behavior"
    noneOpt.setAttribute "DetailLine", "0", 0
    document.all("aBehavior").add noneOpt 
    Set noneOpt = Nothing
        
    set dbconn = CreateObject("ADODB.Connection")
    set dbRS = CreateObject("ADODB.Recordset")
    dbconn.Open "Driver={REMOVED};server=FREAKING;uid=PLAINTEXT;Password=CONNECTION;Database=STRING;dsn=;"
    
    'SQL = "SELECT Key, Category, Desc FROM KSB WHERE Category = " & categoryValue & " ORDER BY KSBDesc"
    SQL = "select ksb.*, cardversion.*, carddetail.* , categories.* "
    SQL = SQL & " from ksb, cardversion, carddetail , categories "
    SQL = SQL & " WHERE CARDVERSION.CARDACTIVE = 1 "
    SQL = SQL & " AND Cardversion.cardid = carddetail.detailcard "
    SQL = SQL & " and carddetail.detailksb = ksb.ksbkey "
    SQL = SQL & " and ksb.ksbcategory = categories.categoryKey "
    SQL = SQL & " and ksb.ksbcategory = " & categoryValue
    SQL = SQL & " order by carddetail.detailline "
    
    dbRS.open SQL, dbconn, 1  
    Do while not dbRS.eof
  
      Dim opt  
      Set Opt = document.createElement("OPTION")
      Opt.value = dbRS.fields("KSBKey")
      Opt.text = dbRS.fields("KSBDesc")
      Opt.setAttribute "DetailLine", CStr(dbRS.fields("DetailLine")), 0
      document.all("aBehavior").add Opt 
      Set Opt = Nothing 
  
      dbRS.MoveNext
    Loop
    dbRS.Close
        
  End Sub

"At first glance," Brent continued, "this didn't look too bad. But then I realized where I was staring at the code. It was in Notepad, launched by Internet Explorer's View->Source option."

"That's right, it was all done client-side by firing off a VBScript when the user picked a category. It connects straight to the database, dynamically constructs an SQL statement, and executes it. Who needs XML web services when you can just go straight to the database? Why have that extra layer when it just slows things down? Brilliant!"

[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!