用Command 对象改善查询

Set cn = Server.CreateObject("ADODB.Connection")
Set cm= Server.CreateObject("ADODB.Command")
cm.CommandText = "INSERT INTO Inventory (Material, Quantity) VALUES (?, ?)"
cm.Prepared = True
cm.Parameters.Append cm.CreateParameter("material_type",200, ,255 )
cm.Parameters.Append cm.CreateParameter("quantity",200, ,255 )

 cm("material_type") = "light bulbs"
 cm("quantity") = "40"
 cm.Execute

 cm("material_type") = "fuses"
 cm("quantity") = "600"
 cm.Execute

strSQL = "INSERT INTO Customers (FirstName, LastName) VALUES ('Robert','O'Hara')" 
注意，姓 O'Hara 中包含一个“'”，它与在 SQL VALUES 关键字中用来表示数据的“'”冲突。通过将查询数值作为 Command 对象参数绑定，可以避免此类问题。