CLASSIC ASP INSERT statement with parameters

Question

I have to mantain a ASP 3.0 website...

And I would like to protect sql statements.

The select statements I could protect with this code:

set cmd = Server.createObject("adodb.command")

cmd.commandText = "select from Foo where id=?"

set cmd.activeConnection = someConnection

set rs = cmd.execute(rows_affected, Array(42))

But I can't make it to work when I replace the select by update or insert statements.

Can anyone help me?

the code i am trying is:

sqlS1 = "INSERT into users (nome2) values (?)"

arParams = 1

set cmd = createobject("ADODB.Command") 

cmd.CommandText = sqlS1 

cmd.ActiveConnection = session("bdc")

cmd.Execute(,arParams,adExecuteNoRecords)

Answer 1

That should run if you drop the parentheses:

cmd.Execute , arParams, adExecuteNoRecords

Or

cmd.Execute recs, arParams, adExecuteNoRecords
Response.write recs & " updated"