In the case of database and LDAP connection actions, PerfectForms™ passes the action details to the connection agent. This then assembles the parameters into a SQL statement (or LDAP query). This means that there is no risk of SQL injection attacks.
Database connection actions can both send and receive data using SQL statements or by running a stored procedure. Database connection action types include:
| • | Select |
| • | Update |
| • | Insert |
| • | Delete |
| • | Stored Procedure |
Using Stored Procedures to Return a Result Set
Returning a result set is necessary in situations where a form has several objects running connect and search commands to return different parameters. For example, a form has two separate tables and each presents a different set of data based on the search command. A DBA should already know how to set up and use a stored procedure in his own database, the only thing that remains is to integrate it into PerfectForms™.
The following example is based on a sample stored procedure for Microsoft’s AdventureWorks database.
USE [AdventureWorks] GO SET ANSI_NULLS ON GO SET QUOTED_IDENTIFIER ON GO ALTER PROCEDURE [dbo].[Get_Managed_Employees] ( @ManagerID int, @Title varchar(50) = NULL out, @Name varchar(100)= NULL out ) AS SELECT @Title=he.Title,@Name = pc.FirstName +' '+ pc.LastName from HumanResources.Employee he inner join Person.Contact pc on he.ContactID = pc.ContactID where he.EmployeeID = @ManagerID;
select EmployeeID,LoginID from HumanResources.Employee where ManagerID = @ManagerID; return 0 GO |
The screenshot below shows the results of the stored procedure in MS-SQL.

|
|
Updated: 06/12/2011
Page url:
http://www.perfectforms.com/Documentation/manual/html/?admin_database_connections_actions.htm
PerfectForms™ -- forms software, workflow software, and business process management