Ado Parameter in ASP
In Classic ASP, when using ADO with ADODB.Command to run SQL queries or stored procedures, parameters are used to safely pass values and avoid SQL injection.
? What is an ADO Parameter?
A parameter represents a value passed to a SQL query or stored procedure.
Helps avoid concatenating strings directly in SQL.
Specifies data type, direction, and optionally size.
? How to Use Parameters with ADODB.Command in ASP
Example: Parameterized INSERT Query
<%Dim conn, cmd' Open connectionSet conn = Server.CreateObject("ADODB.Connection")conn.Open "Provider=SQLOLEDB;Data Source=SERVER;Initial Catalog=DB;User ID=USER;Password=PASS;"' Create CommandSet cmd = Server.CreateObject("ADODB.Command")Set cmd.ActiveConnection = conncmd.CommandText = "INSERT INTO Users (Name, Email) VALUES (?, ?)"cmd.CommandType = 1 ' adCmdText' Add Parameterscmd.Parameters.Append cmd.CreateParameter("Name", 200, 1, 50, "John Doe") ' 200 = adVarChar, 1 = adParamInputcmd.Parameters.Append cmd.CreateParameter("Email", 200, 1, 100, "john@example.com")' Executecmd.Execute' Clean upSet cmd = Nothingconn.CloseSet conn = Nothing%>Parameter Syntax:
CreateParameter(Name, Type, Direction, Size, Value)| Argument | Description |
|---|---|
Name | Parameter name (optional in some cases) |
Type | Data type constant (e.g., 200 = adVarChar) |
Direction | 1 = input, 2 = output, 3 = input/output |
Size | Max length for strings, bytes for binary data |
Value | Actual value to pass |
Common ADO Data Types
| Data Type | Value |
|---|---|
adVarChar | 200 |
adInteger | 3 |
adBoolean | 11 |
adDate | 7 |
Why Use Parameters?
Prevents SQL Injection
Handles data types properly
Makes code cleaner
Want me to show using parameters with stored procedures or output parameters?
