使用ADODB.Command.Execute设置CursorType

Ale*_*nor 9 sql vbscript sql-injection adodb asp-classic

有什么办法来设置CursorTypeADODB.RecordSet我从获得ADODB.Command.Execute

我知道如果我这样做有可能:

rs = Server.CreateObject("ADODB.RecordSet")
rs.Open(cmd)
Run Code Online (Sandbox Code Playgroud)

不过,我目前使用Command.ExecuteParameters参数,自动处理的变型阵列?安全插补参数.因此使用RecordSet.Open似乎不是一种选择.

具体来说,我的代码目前看起来像:

function ExecuteSQL(conn, sql, args)
    set ExecuteSQL_CmdObj = Server.CreateObject("ADODB.Command")
    ExecuteSQL_CmdObj.CommandType = adCmdText
    ExecuteSQL_CmdObj.CommandText = sql
    ExecuteSQL_CmdObj.ActiveConnection = conn
    if Ubound(args) = -1 then
        set ExecuteSQL = ExecuteSQL_CmdObj.Execute
    else
        set ExecuteSQL = ExecuteSQL_CmdObj.Execute(,args)
    end if
end function
Run Code Online (Sandbox Code Playgroud)

如果我想维护这个相同的API,还要控制CursorType,如何实现呢?

Ale*_*nor 1

据我所知,答案是,使用 是不可能的,但使用ADODB.Command.Execute是可能的:ADODB.RecordSet.OpenADODB.Command.Parameters

function CreateSQLParameter(arg)
    set param = Server.CreateObject("ADODB.Parameter")

    select TypeName(arg)
        case "String"
            param.Type = adVarChar
            param.Size = Len(CStr(arg))
            param.Value = CStr(arg)
        case "Integer"
            param.Type = adInteger
            param.Value = CLng(arg)
        case "Double"
            param.Type = adDouble
            param.Value = CDbl(arg)
        case else
            ' 13 is the "Type Mismatch" error code
            Err.Raise(13,,, "Type '" & TypeName(arg) "' is not handled. Please add support for it to CreateSQLParameter")
    end select

    set CreateSQLParameter = param
end function

function CreateSQLCommand(sql, args)
    set cmd = Server.CreateObject("ADODB.Command")
    'From http://www.w3schools.com/asp/prop_comm_commandtype.asp.
    'adCmdText is for some reason undefined in our scope.
    cmd.CommandType = 1
    cmd.CommandText = sql

    for i = Lbound(args) to Ubound(args)
        set param = CreateSQLParameter(args(i))
        cmd.Parameters.Append(param)
    next

    set CreateSQLCommand = cmd
end function

function ExecuteSQL(conn, sql, args)
    set cmd = CreateSQLCommand(sql, args)
    set rs = Server.CreateObject("ADODB.RecordSet")
    rs.Open(cmd, conn)

    set ExecuteSQL = rs
end function
Run Code Online (Sandbox Code Playgroud)

  • 其中“CursorType”在哪里设置? (3认同)
  • 光标类型在哪里? (2认同)