Every sample I've seen uses stored procedures. I've adopted an old application written in Classic ASP that uses inline SQL. This is an obvious issue, so I need to convert it to safer code. The client does not wish that I use stored procedures in this application, so is there a way to run parameterized queries without stored procedures?
Thanks
Yes, there is. Have a look at some of these examples:
http://www.securestate.blogspot.com/2008/09/classic-asp-sql-injection-prevention_30.html http://www.userfriendlythinking.com/Blog/BlogDetail.asp?p1=7013&p2=119&p7=3001
Is there any reason why the client doesn't want to use stored procedures? It is much easier to use stored procedures both on the database level as well as in your source code. You should get query plan caching on your inline query if you use the second method from above, but depending on what you are doing you might be better off with simple sprocs if you can convince your client that it's ok to use them. If all else fails the links above are pretty solid, especially the second one.
来源：https://stackoverflow.com/questions/1188024/parameterized-queries-without-stored-procedures