SQL参数化插入查询

Question

我正在尝试使用parameterizartion来防止SQL注入到我使用的HMI的文本框中之一。

寻找了很多解决方案，我收集的内容取决于存在的SQL语法，我可以使用?或@来告诉系统这是参数，但是两者都抛出错误。

Dim DBCommand
Dim DBRecordSet 
Dim Connection
Dim sqlString   

Set DBRecordSet = CreateObject("ADODB.Recordset") 
Set DBCommand = CreateObject("ADODB.Command")
Set Connection = GetDBConnection("Test")

sqlString = "Insert into [WorkCommentLog] (Worklog_WorkID, Comment, 
InsertTime, WrittenBy) values" &_
"('"& WorkID &"' , @Comm , GetDate() , '" & User.Value &"');"

DBCommand.Parameters.Append DBCommand.CreateParameter ("@Comm", 
adVarChar, adParamInput, 255, WinCC_Comment.Value)

DBCommand.CommandText = sqlString
DBCommand.Execute(adExecuteNoRecords)

Connection.Close

Dim DBCommand
Dim DBRecordSet 
Dim Connection
Dim sqlString   

Set DBRecordSet = CreateObject("ADODB.Recordset") 
Set DBCommand = CreateObject("ADODB.Command")
Set Connection = GetDBConnection("Test")

sqlString = "Insert into [WorkCommentLog] (Worklog_WorkID, Comment, InsertTime, WrittenBy) values" &_
"('"& WorkID &"' , ? , GetDate() , '" & User.Value &"');"

DBCommand.Parameters.Append DBCommand.CreateParameter ("Comment", adVarChar, adParamInput, 255, WinCC_Comment.Value)
DBCommand.CommandText = sqlString
DBCommand.Execute(adExecuteNoRecords)

Connection.Close

第一个代码段引发此错误：

  

必须声明标量变量“ @Com”

第二个代码段引发此错误：

  

没有为一个或多个必需参数提供值