使用ADODB.Command.Execute设置CursorType

时间:2016-10-19 14:32:12

标签: sql vbscript asp-classic sql-injection adodb

有没有办法设置我从CursorType获得的ADODB.RecordSet的{​​{1}}?

我知道如果我这样做是可能的:

ADODB.Command.Execute

但是,我目前使用rs = Server.CreateObject("ADODB.RecordSet") rs.Open(cmd) Command.Execute参数,该参数自动处理Parameters参数的变量数组以进行安全插值。因此,使用?似乎不是一种选择。

具体来说,我的代码目前看起来像是:

RecordSet.Open

如果我想维护这个相同的API,但控制function ExecuteSQL(conn, sql, args) set ExecuteSQL_CmdObj = Server.CreateObject("ADODB.Command") ExecuteSQL_CmdObj.CommandType = adCmdText ExecuteSQL_CmdObj.CommandText = sql ExecuteSQL_CmdObj.ActiveConnection = conn if Ubound(args) = -1 then set ExecuteSQL = ExecuteSQL_CmdObj.Execute else set ExecuteSQL = ExecuteSQL_CmdObj.Execute(,args) end if end function ,那么如何实现呢?

2 个答案:

答案 0 :(得分:1)

我已经能够确定的答案是ADODB.Command.Execute这是不可能的,但使用ADODB.RecordSet.Open ADODB.Command.Parameters可以做到这一点:

function CreateSQLParameter(arg)
    set param = Server.CreateObject("ADODB.Parameter")

    select TypeName(arg)
        case "String"
            param.Type = adVarChar
            param.Size = Len(CStr(arg))
            param.Value = CStr(arg)
        case "Integer"
            param.Type = adInteger
            param.Value = CLng(arg)
        case "Double"
            param.Type = adDouble
            param.Value = CDbl(arg)
        case else
            ' 13 is the "Type Mismatch" error code
            Err.Raise(13,,, "Type '" & TypeName(arg) "' is not handled. Please add support for it to CreateSQLParameter")
    end select

    set CreateSQLParameter = param
end function

function CreateSQLCommand(sql, args)
    set cmd = Server.CreateObject("ADODB.Command")
    'From http://www.w3schools.com/asp/prop_comm_commandtype.asp.
    'adCmdText is for some reason undefined in our scope.
    cmd.CommandType = 1
    cmd.CommandText = sql

    for i = Lbound(args) to Ubound(args)
        set param = CreateSQLParameter(args(i))
        cmd.Parameters.Append(param)
    next

    set CreateSQLCommand = cmd
end function

function ExecuteSQL(conn, sql, args)
    set cmd = CreateSQLCommand(sql, args)
    set rs = Server.CreateObject("ADODB.RecordSet")
    rs.Open(cmd, conn)

    set ExecuteSQL = rs
end function

答案 1 :(得分:0)

这是完成此任务的快速简便的方法:

'''

Dim arrErrorCode(1,1)
Dim ArrayRS

On Error Resume Next
            
Set rsGetIPInfo = Server.CreateObject("ADODB.Recordset")
Set oCMD = Server.CreateObject("ADODB.Command")
            
sSQL = "SELECT * FROM RemoteIPInfo WHERE RemoteIP_ID = ?"
            
oCMD.ActiveConnection = oConnGlobal
oCMD.CommandText = sSQL
oCMD.CommandType = adCmdText
oCMD.CommandTimeout = 120
oCMD.Parameters.Append oCMD.CreateParameter("@RemoteIP_ID", adVarChar, adParamInput, ,RemoteIP_ID)

rsGetIPInfo.CursorLocation = adUseClient
rsGetIPInfo.Open oCMD, ,adOpenStatic, adLockReadOnly
GetIPInfoCount = rsGetIPInfo.RecordCount

' For testing only:
iIPID = rsGetIPInfo("RemoteIP_ID")
            
        
If Not rsGetIPInfo.BOF And Not rsGetIPInfo.EOF Then
    ArrayRS = rsGetIPInfo.GetRows()
End If
            
arrRowNumberIPInfo = Ubound(ArrayRS, 1)  

            
If Err.Number > 0 Then 
    arrRowNumberErrorCode = Ubound(arrErrorCode, 1)  
    Response.Write("Error Number: ") & Err.Number & "<br>"
    Response.Write("Error Description: ") & Err.Description & "<br>"
    Response.Write("Error Source: ") & Err.Source & "<br>"
    Err.Raise 13
    Response.End
                
End If

rsGetIPInfo.Close
Set rsGetIPInfo = Nothing

On Error Goto 0