I'm working on a legacy system (classic ASP) where the original code will execute an in-line dynamic query (based on user input) to determine the sort order. For example:
Dim query = "Select * from empTable order by " & //some user input
Besides the potential SQL injection, the other problem with this kind of method is, each time the user wants to sort the result, it will call to the database. (and thus - my boss claimed - will cause some performance issues).
I proposed to use an array
to store the return results from the query (and then sort within the array
) but it was not approved by the management (I do not know the reason). I cannot use Javascript either. My supervisor told me to explore the XML element. So my questions are:
- How does XML help in sorting the result without calling the database?
- If not, what are my other options?
Edited: So according to my supervisor, calling to the IIS server is fine, but calling to the database server IS NOT acceptable.