<%! String dataSrcStr; %>
<%@ include file="checkDataSource.jsp" %>

<%@ taglib uri="http://xmlns.oracle.com/j2ee/jsp/tld/ojsp/sqltaglib.tld" prefix="sql" %>
<HTML> 
<HEAD><TITLE>DML Sample</TITLE></HEAD>
<BODY BGCOLOR="#FFFFFF"> 
<FORM METHOD=post>
<TABLE BORDER=0 CELLSPACING=0 CELLPADDING=0 WIDTH="20%">
<TR><TD>empno:</TD><TD><INPUT TYPE="text" name="empno"></TD></TR>
<TR><TD>ename:</TD><TD><INPUT TYPE="text" name="ename"></TD></TR>
</TABLE>
<INPUT TYPE="submit" name="query" VALUE="Query"><br>
</FORM>
<HR>
Query:select * from EMP where empno=? and ename like '{@name}%'
<HR>
<%-- check for space in textual parameters to prevent unintended sql --%>
<% if (request.getParameter("empno") != null && !request.getParameter("empno").equals("") && (request.getParameter("ename")).indexOf(' ') == -1) {
%>
<P>
empno: <%= request.getParameter("empno") %><br>
ename: <%= request.getParameter("ename") %><br>
Result:
            <HR>
            <sql:dbOpen dataSource="<%= dataSrcStr %>" connId="con1" >
            </sql:dbOpen>
            <sql:dbQuery connId="con1" bindParams="empno">
               select * from EMP where empno=? and ename like '{@ename}%'
               order by empno
            </sql:dbQuery>
            <sql:dbClose connId="con1" />
            <HR> 
<% }
%>
</BODY> 
</HTML> 


