Classic ASP SQL Injection

Question

I recently inherited a classic asp website with a ton of inline SQL insert statements that are vulnerable to SQL injection attacks.

These insert statements are executed via the ADO command object.

Will setting the ADO Command Object's Prepared property to true ensure that the query is parameterized before execution, thus mitigating the risk of SQL injection?

Answer 1

This Link should prove useful.

Classic ASP SQL Injection Protection

Answer 2

No, if you build a SQL string with values that you get directly from "outside", then a "prepared statement" will not help you.

a

sSQL = "SELECT * from mytable where mycolumn = '" + querystring("value") + "'"

is still asking for trouble. The only way to solve this is by using parameters in your query.