How can I make a prepared statement in classic asp that prevents sql injection?

Question

I have this which works:

sqlString = \"SELECT * FROM employees WHERE lastname = \'\" & last_name & \"\'\"
Set cmd = Server.CreateObject(\"ADODB.Comma         


        

Answer 1

Here's a good blog on how to prevent sql injection using classic asp.

http://blogs.iis.net/nazim/archive/2008/04/28/filtering-sql-injection-from-classic-asp.aspx

Answer 2

Why not use ADO command parameters?

var oCmd = Server.CreateObject("ADODB.Command");
oCmd.CommandText = "SELECT * FROM employees WHERE lastname = ?";
oCmd.Parameters.Append(oCmd.CreateParameter(undefined,202, 1, 50,"last name"))//adVarWChar

Answer 3

The easiest is using stored procedures in SQL and using Commands that way.. Otherwise, you have to escape out certain characters being gathered from the Request object, like single quotes and double hyphens, etc.