我需要幫助參數化一個.asp文件中的一些VBScript代碼

Question

這是我正在處理的一個片段。請讓我知道如果我需要發佈更多：

<% @ LANGUAGE = VBScript ENABLESESSIONSTATE = False %> 

<!--#include file="Connections/ConnectionString.asp" --> 
<!--#include file="SqlCheckInclude.asp" --> 

<% 
    Dim LoginTest 
    LoginTest = "" 

    If Request.QueryString("Action") = "Login" Then 
     Dim IsUserNameLocked 
     Set IsUserNameLocked = Server.CreateObject("ADODB.Recordset") 
     IsUserNameLocked.ActiveConnection = ConnectionString 
     sProUserName = Request.Form("ProUserName") 
     sanitizedProUserName = "'" & Replace(sProUserName, "'", "''") & "'" 
     Response.Write(sanitizedProUserName) 
     Response.End() 
     IsUserNameLocked.Source = "SELECT IL_Date, IL_Timer, IL_NumOfTimes, ProUserName FROM PROFILE WHERE ProUserName =" & sanitizedProUserName 
     IsUserNameLocked.CursorType = 2 
     IsUserNameLocked.CursorLocation = 3 
     IsUserNameLocked.LockType = 3 
     IsUserNameLocked.Open 
     if not IsUserNameLocked.eof then 
      intNumOfIncorrectLogin = IsUserNameLocked("IL_NumOfTimes") 
      InCorrectLoginDate = IsUserNameLocked("IL_Date") 
      InCorrectLoginTime = IsUserNameLocked("IL_Timer") 
     end if 
     IsUserNameLocked.close 
     set IsUserNameLocked = nothing 
    end if 
%> 

我試圖將其轉換爲：

If Request.QueryString("Action") = "Login" Then 
    Dim IsUserNameLocked 
    Set IsUserNameLocked = Server.CreateObject("ADODB.Recordset") 
    IsUserNameLocked.ActiveConnection = ConnectionString 
    strSql = "SELECT IL_Date, IL_Timer, IL_NumOfTimes, ProUserName FROM PROFILE WHERE ProUserName = ?" 
    strSearch = Request.Form("ProUserName") 
    set objCommand = Server.CreateObject("ADODB.Command") 
    objCommand.ActiveConnection = ConnectionString 
    objCommand.CommandText = strSql 
    objCommand.Parameters(0).value = strSearch 
    IsUserNameLocked.results = objCommand.Execute() 
    IsUserNameLocked.CursorType = 2 
    IsUserNameLocked.CursorLocation = 3 
    IsUserNameLocked.LockType = 3 
    IsUserNameLocked.Open 
end if 

但這並沒有工作。我一直在網上搜索過去幾個小時試圖找到一個正確工作的方法，但我沒有得到正常運行的結果。如果有人可以請一個正確參數化和防止SQL注入的實現請幫忙，我將非常感激。

Answer 1

根據docs，您需要在Command的參數集合中添加一個參數。證據：

>> Set oCmd = CreateObject("ADODB.Command") 
>> WScript.Echo "# parameters", oCmd.Parameters.Count 
>> oCmd.Parameters(0).Value = "no such thing" 
>> 
# parameters 0 
Error Number:  3265 
Error Description: Item cannot be found in the collection corresponding to the requested name or ordinal. 

您是否使用全局錯誤繼續？