有没有在asp中用过sql参数化，求代码。。。

在asp中用过sql参数化，求代码。。。
Set parameter = command.CreateParameter (Name, Type, Direction, Size, Value) 
Set conn = Server.CreateObject("Adodb.Connection") 
conn.ConnectionString = connString 
conn.open() 
set mycmd = Server.CreateObject("ADODB.Command") 
mycmd.ActiveConnection=conn 
mycmd.CommandText=sql 
mycmd.Prepared = true 
set mypar = mycmd.CreateParameter("temp",129,1,50,"tsing") 
mycmd.Parameters.Append mypar 
set myrs = mycmd.Execute 
我这样写，可是asp中能用Set parameter = command.CreateParameter (Name, Type, Direction, Size, Value) 
这个吗？

可以啊
VBScript code

<%
Set conn = CreateObject("ADODB.Connection")
conn.Open "Provider=SQLNCLI;Server=127.0.0.1;Database=XXXX;Uid=sa;Pwd=sa;"
login_name = "张三1"

sql = "SELECT * FROM tbl_test WHERE username=?"
Set cmd = CreateObject("ADODB.Command")
Set cmd.ActiveConnection = conn
cmd.CommandText = sql
cmd.CommandType = 1
cmd.Prepared = True
Set prm = cmd.CreateParameter("login_name", 200, 1, 50, login_name)
cmd.Parameters.Append prm
Set rs = CreateObject("ADODB.RecordSet")
rs.CursorLocation = 3
rs.Open cmd, , 1, 3
If rs.BOF And rs.EOF Then
    rs.AddNew
    rs("title").Value = "xxx"
    rs("username").Value = login_name
    rs.Update
Else
    WScript.Echo "xxxx"
End If
rs.Close
Set rs = Nothing
Set cmd = Nothing
Set prm = Nothing
conn.Close
Set conn = Nothing

%>