不包含动态 sql CommandType 的副作用？

发布于 2024-07-29 08:48:25 字数 734 浏览 9 评论 0原文

运行动态 sql 调用时，如果不设置 cmd.CommandType 属性，可能会遇到哪些陷阱？我无法使用 adovbs.inc，并且使用 cmd.CommandType = 200 会产生错误：

ADODB.Command (0x800A0BB9) 参数类型错误，超出范围可以接受的范围，或者有冲突彼此之间。

因此，通过注释掉这一行，一切似乎都按计划进行。但是，我可能会遇到哪些问题？

这是一段代码，用于上下文。

        Dim cmd
        Set cmd = Server.CreateObject("ADODB.Command")
        cmd.ActiveConnection = dbConn
        cmd.CommandText = "SELECT * FROM Users WHERE active = 1 AND username=? AND password=?"
        cmd.CommandType = 200 'advarchar
        cmd.Parameters(0) = request.form("username")
        cmd.Parameters(1) = request.form("password")
        Dim RS
        Set RS = cmd.Execute()

原文

What pitfalls may I encounter by not setting the cmd.CommandType attribute when running a dynamic sql call? I can not use adovbs.inc, and using cmd.CommandType = 200 yields the error:

ADODB.Command (0x800A0BB9) Arguments
are of the wrong type, are out of
acceptable range, or are in conflict
with one another.

So by commenting this line out, everything appears to be working as planned. However, what issues may I run into?

Here is a snippet of the code, for context.

        Dim cmd
        Set cmd = Server.CreateObject("ADODB.Command")
        cmd.ActiveConnection = dbConn
        cmd.CommandText = "SELECT * FROM Users WHERE active = 1 AND username=? AND password=?"
        cmd.CommandType = 200 'advarchar
        cmd.Parameters(0) = request.form("username")
        cmd.Parameters(1) = request.form("password")
        Dim RS
        Set RS = cmd.Execute()

分享到QQ

分享到微博