Using Sql Parameters Returns "arguments Are Of The Wrong Type"

I am having some trouble figuring out how to write classic ASP queries to prevent SQL injection. I have read a few posts on it and have come up with the following script; set cmd =

Solution 1:

adVarchar, adCmdText and adParamInput are constant values that need to be defined before they can be used. There are a number of ways you can do this:

1. Define just the constants you require manually:

   const adVarChar = 200const adParamInput = &H0001
   const adCmdText = &H0001
   

2. Use the values directly (this is less readable / maintable and generally not recommended):

   cmd.Parameters.Append cmd.CreateParameter("@name", 200, &H0001, 50, "%" & this.Form("email") & "%")
   

3. Include a adovbs.inc which defines all of the ADO constants in a handy include file:

   <!--#include virtual="/adovbs.inc"-->

   The adovbs.inc file itself is available for download in lots of places on the web (make sure you give it a quick scan to check it doesn't include anything nasty), the 4GuysFromRolla site being a popular one (download the .txt linked and rename it to .inc)

4. Include a reference to the ADO TypeLib:

   <!--metadata type="TypeLib" name="Microsoft ActiveX Data Objects 2.8 Library" uuid="{2A75196C-D9EB-4129-B803-931327F72D5C}" version="2.8"-->