How do I run a parameterized SQL query in classic ASP? And is it secure?

Question

I\'m about to have to deal with some SQL code in classic ASP VBScript.

I have two questions.

First, in .net, I\'m used to using the System.Data.SqlClient nam

Answer 1

There are ADODB Objects which do basically the same thing. ADODB.Command object is the equivalent to SqlCommand. From there it is basically doing the same as in .NET.

set cmd = Server.CreateOject("ADODB.Command")
cmd.CommandText = "select From Table where ID = @id")
set param = cmd.CreateParameter("@id", adInteger, adInput,0,0)

I frequently use w3schools for help about ADO objects.