Solutions to asp Injection Vulnerabilities

 

I have recently studied a thorough solution to the asp injection vulnerability! I hope you will give more suggestions.
The principle is to use preparestatement Like java.
The following example connects to the SQL server database.
The Code is as follows:
PrepareSql. asp
<%
'Define database operation Constants
Const adStateClosed = 0
Const adOpenForwardOnly = 0, adOpenKeyset = 1, adOpenDynamic = 2, adOpenStatic = 3
Const adLockReadOnly = 1, adLockPessimistic = 2, adLockOptimistic = 3, adLockBatchOptimistic = 4
Const ad1_text = 1, adCmdTable = 2, ad1_storedproc = 4, adExecuteNoRecords = 128
Const adBigInt = 20, adBoolean = 11, adChar = 129, adDate = 7, adInteger = 3, adSmallInt = 2, adTinyInt = 16, adVarChar = 200
Const adParamInput = 1, adParamOutput = 2, adParamInputOutput = 3, adParamReturnValue = 4
%>
<% Class PrepareSQL
Private encrypted prep
Private m_String
Private m_ SQL
Private m_conn
Public function setconn (conn)
Set m_conn = conn
End function
Public Function prepare (SQL)
Set Rule prep = nothing
SET Topology prep = Server. CreateObject ("ADODB. Command ")
Set parameter prep. ActiveConnection = m_conn
Optional prep. CommandText = SQL
End Function
Public Function setInt (theValue)
Parameters prep. Parameters. Append Parameters prep. CreateParameter ("", adInteger, adParamInput, theValue)
End Function
Public Function setDate (theValue)
Parameters prep. Parameters. Append Parameters prep. CreateParameter ("", adVarChar, adParamInput, 100, theValue)
End Function
Public Function setBoolean (theValue)
Parameters prep. Parameters. Append Parameters prep. CreateParameter ("", adBoolean, adParamInput, 1, theValue)
End Function
Public Function setString (theValue)
If (len (theValue) = 0) then

Parameters prep. Parameters. Append Parameters prep. CreateParameter ("", adVarChar, adParamInput, 1, theValue)
Else
Parameters prep. Parameters. Append Parameters prep. CreateParameter ("", adVarChar, adParamInput, lenb (theValue), theValue)
End if
End Function
Public Function execute ()
Set execute = route prep. Execute
End Function
End Class %>

Test. asp
<! -- # Include file = "../include/datastore. asp" -->
<! -- # Include file = "../include/PrepareSql. asp" -->
<%
Dim ps
Dim cn
Set cn = server. CreateObject ("adodb. connection ")
Dim strcn
StrCn = "driver = {SQL server}; server = 127.0.0.1; uid = sa; pwd = test; database = PUBS"
Cn. Open strCn
Set ps = new PrepareSql
Ps. setconn cn
Ps. prepare "select * from user where id =? "
Ps. setint 1
Dim rs
Set rsw.ps.exe cute
%>