Mysql / Classic Asp - Parameterized Queries

In an absolute emergency, I am trying to go through my website and add parameterized queries. I'm a newbie and have only just learnt about them. My problem is, I only know a very l

Solution 1:

The code in your second snippet is correct, but should be applied to a new ADODB.Command object, not to the Connection object:

username = Trim(Request("username"))

'-----Added this-----Dim cmdContent
Set cmdContent = Server.CreateObject("ADODB.Command")

' Use this line to associate the Command with your previously opened connectionSet cmdContent.ActiveConnection = connContent
'--------------------

cmdContent.Prepared = TrueConst ad_nVarChar = 202Const ad_ParamInput = 1

SQL = " SELECT * FROM users WHERE (username=?) ; "Set newParameter = cmdContent.CreateParameter("@username", ad_nVarChar, ad_ParamInput, 20, username)
cmdContent.Parameters.Append newParameter

cmdContent.CommandText = SQL
Set rs = cmdContent.Execute

IfNOT rs.EOF Then' Do something...EndIf

rs.Close

By the way, there was a typo with the spelling of adParamInput instead of ad_ParamInput (corrected in my example).