How to pass variables to ASP query - html

Question

I am an ASP beginner trying to make a very simple page. The functionality is to accept two inputs from the user and display a report based on those on the next page. The data for the report is fetched a SQL query on the ASP page.
This is what I have done till now:
Set objConn = Server.CreateObject("ADODB.Connection")
objConn.Open "Provider=MSDAORA;
Data Source=şemam;
User Id=xyz;
Password=xyz;"
aranan = Request("aranan")
Set objRs = objConn.Execute("select * from my_department where user_id = <input from user>")
if objRs.BOF and objRs.eof then
response.end
end if
The problem I am facing is that I cannot find how to properly pass the user input in the query.
Please help!

Answer 1

Use ? as a placeholder, then pass the parameters into the Execute method.
dim paramArray(0)
paramArray(0) = 123
Set objRs = objConn.Execute("select * from my_department where user_id = ?", paramArray)

Answer 2

To send parameters to a database query you need to use a command-object.
Set objConn = Server.CreateObject("ADODB.Connection")
objConn.Open "Provider=MSDAORA;" & _
"Data Source=şemam;" & _
"User Id=xyz;" & _
"Password=xyz;"
aranan = Request("aranan")
Set objCmd = Server.CreateObject("ADODB.Command")
Set objCmd.ActiveConnection = objConn
objCmd.CommandText = "SELECT * FROM my_department WHERE user_id = ?"
objCmd.CommandType = 1
Set objRs = objCmd.Execute(, array(aranan))
if not objRs.EOF then
' Do whatever you need to with the result...
end if
objRs.Close
objConn.Close
Don't end the response before you closed the connection otherwise you will end up exhausting your connectionpool.