derrickmoscow
New Member
I am using classic ASP with a parameterized SQL querystring as follows:\[code\]SQL = "SELECT * FROM content WHERE Category LIKE ? ORDER BY SubDate ?"\[/code\]The SQL query string is being used in the following parameterized code:\[code\]Set cmd = Server.CreateObject("ADODB.Command")Set rsView = Server.CreateObject("ADODB.Recordset")cmd.ActiveConnection = MM_connContent_STRINGcmd.Prepared = truecmd.CommandType = adCmdTextcmd.CommandText = SQLcmd.CommandTimeout = 60cmd.Parameters.Append(cmd.CreateParameter("Category", 202, adParamInput, 30, qFilter))cmd.Parameters.Append(cmd.CreateParameter("SubDate", 202, adParamInput, 10, myDateSort))rsView.CursorLocation = adUseClientrsView.Open cmd, , adOpenForwardOnly, adLockReadOnly\[/code\]The code above works great except for one huge problem. The "ORDER BY SubDate ?" part outputs "ORDER BY SubDate 'DESC'" where DESC has single quotes around it added due to the fact that it is a parameter. I get a bad syntax error when running the code above because of the single quotes around DESC (which can also be ASC depending on what the user selects and sends through the URL query string). It seems all SQL parameters are output with single quotes. How can I remove the single quotes from specific SQL parameters so they don't create syntax errors in the SQL string?