Last updated: August 26, 2026.
Classic ASP connects to databases through ADO. Keep the connection string in protected server configuration, open the connection shortly before use, and parameterize values supplied by users.
<%
Dim conn
Set conn = Server.CreateObject("ADODB.Connection")
conn.Open Application("DatabaseConnectionString")
%>Parameterized query
<%
Dim cmd, customerId
customerId = CLng(Request.QueryString("id"))
Set cmd = Server.CreateObject("ADODB.Command")
Set cmd.ActiveConnection = conn
cmd.CommandText = "SELECT CompanyName FROM Customers WHERE CustomerID = ?"
cmd.CommandType = 1
cmd.Parameters.Append cmd.CreateParameter("CustomerID", 3, 1, , customerId)
Dim rs
Set rs = cmd.Execute
%>Use a supported database driver, encrypted connections, and a dedicated least-privilege login.
Building database pages? PHPRunner can generate authenticated forms and reports.
