title: How do I run a parameterized SQL query in classic ASP? And is it secure?
body: <p>I'm about to have to deal with some SQL code in classic ASP VBScript.</p>
  
  <p>I have two questions.</p>
  
  <p>First, in .net, I'm used to using the System.Data.SqlClient namespace objects to perform queries.  For example:</p>
  
  <pre><code>Dim conn as New SqlConnection("Data Source=MyServer;uid=myUid;pwd=myPwd;Initial Catalog=myDataBase;"  
  Dim cmd as New SqlCommand("Select fname From myTable where uid=@uid;", conn)  
  cmd.Parameters.add(New SqlParameter("@uid",100323)  
  conn.open()
  Response.Write(cmd.ExecuteScalar())
  conn.Close()
  </code></pre>
  
  <p>I've been told that using a parameterized query as such makes my query secure from SQL injection attacks.</p>
  
  <p>I'd like to know what is the equivalent code to do such a query in classic ASP with VBScript and what similar security precautions must be used to guard against SQL injection.</p>