Calling stored procedure in asp - question

Hi Everyone,

I've seen a couple ways to do this from an asp page. One is appending the parameters and setting their values. Then I came across another web page that showed it like this:

Code:

---



'Connection Execute Method String

set connection = server.createobject("adodb.connection")
connection.open someDSN
Connection.Execute "procname varvalue1, varvalue2"

'Close all objects and set to nothing
connection.close
set connection = nothing

**********************************
'Using Recordset Method
set connection = server.createobject("adodb.connection")
connection.open someDSN
set rs = server.createobject("adodb.recordset")
rs.Open "Exec procname varvalue1, varvalue2",connection

'Close all objects and set to nothing
rs.close
connection.close
set rs = nothing
set connection = nothing

---

In this routine above they are just adding the parameters after the sproc name. And I assume they must be in order as the parameters are defined in the sproc. Is it fine to do it this way? I'm sure others prefer the other way because it looks must more stable by defining each @param name and value.

Thanks!

I've never seen it done that way. Does it work?

I'll know tonight and let you know.

Warren

1) Yes it does work
2) Is it a fine way to do this? Maybe... if you have something that runs with the same parameters all the time, it's probably OK to hardcode them like that... if you are using user input values as the parameters I DO NOT SUGGEST THIS method.... it's basically the same as concatenating a SQL string and running it blindly. And it is prone to SQL Injection attacks... and can make it harder to track down problems (most common of which is "Why does it take smith but breaks on o'connel"?
It's better and safer, MUCH SAFER, to use parameters. Did I mention that it's safer to use parameters?

-tg

Thanks - I knew someone would say this which is a good thing. I'll go the other route and set the parameters rather than passing them in like the example shown.