A Parameterized SQL Query is used to do a few things.

Retrieve data from a database to present on the webpage.
Help protect your database from [SQL Injections] when data is inserted into the datbase.

Below, I am going to list the different methods I use to perform these very powerful actions to retrieve information from [SQL Server] and display it on our [Classic ASP]/[VBScript] coded page.

To return a single record based on a [QueryString] value.
[Example 1]

[ASP VBScript Classic - Parameterized SQL Query]

CFFCS | CarrzSynEdit: | ASP/VBScript


<%
getTID = Request.QueryString("TID")
Set sqlTracks = CreateObject("ADODB.Command")
sqlTracks.ActiveConnection=siteconn
sqlTracks.Prepared = true
sqlTrack = "Select TrackName from TRail where TID = ?"
sqlTracks.commandtext = sqlTrack
sqlTracks.Parameters.Append sqlTracks.CreateParameter("@TID", adInteger, adParamInput, , getTID)
set rsTracks = sqlTracks.execute
if rsTracks.eof then
response.write "Sorry, there is no record for that Track in our Database."
else
strTrackName = rsTracks("TrackName")
%>
You are viewing information on the Train Track <%=strTrackName%>
<%
' Close RecordSet

rsTracks.close
set rsTracks = nothing
' Close Database Connection

siteconn.close
set siteconn= nothing
end if%>

To return multiple records based on a [QueryString] value.
[Example 2]

[ASP VBScript Classic - Parameterized SQL Query w/While Loop]

CFFCS | CarrzSynEdit: | ASP/VBScript


<%
getTID = Request.QueryString("TID")
Set sqlTracks = CreateObject("ADODB.Command")
sqlTracks.ActiveConnection=siteconn
sqlTracks.Prepared = true
sqlTrack = "Select TrackName from TRail where TID = ?"
sqlTracks.commandtext = sqlTrack
sqlTracks.Parameters.Append sqlTracks.CreateParameter("@TID", adInteger, adParamInput, , getTID)
set rsTracks = sqlTracks.execute
if rsTracks.eof then
response.write "Sorry, there is no record for that Track in our Database."
else%>
You are viewing information on the Train Track 
<%while not rsTracks.eof
strTrackName = rsTracks("TrackName")
%>
<%=strTrackName%>
<%rsTracks.movenext
wend
' Close RecordSet

rsTracks.close
set rsTracks = nothing
' Close Database Connection

siteconn.close
set siteconn= nothing
end if%>

Next is one I've used in the past for a large [SQL Statement], but I stopped using it because I didn't know how to use it.
However, I just began redesigning our Radio site and will implement this for all complex loops [Queries].
[Example 3]
(Updated [February 26, 2026], to remove old code that I mistakenly left in. Sorry)

[ASP VBScript Classic - Parameterized SQL Query w/getRows]

CFFCS | CarrzSynEdit: | ASP/VBScript


<%
getTID = Request.QueryString("TID")
Set sqlTracks = CreateObject("ADODB.Command")
sqlTracks.ActiveConnection=siteconn
sqlTracks.Prepared = true
sqlTrack = "Select TID, TrackName from TRail where TID = ?"
sqlTracks.commandtext = sqlTrack
sqlTracks.Parameters.Append sqlTracks.CreateParameter("@TID", adInteger, adParamInput, , getTID)
set rsTracks = sqlTracks.execute

If rsTracks.EOF Then
   response.write "Sorry, there is no record for that Track in our Database."
else
    arrTracks = rsTracks.GetRows() ' Loads data into an array

End If
rsTracks.close
set rsTracks = nothing

If IsArray(arrTracks) Then
For Track = 0 To UBound(arrTracks, 2)
%>
You are viewing information on the Train Track 
<%
strTrackName = arrTracks(0,Track)
%>
<%=strTrackName%>
<%next
end if
' Close Database Connection

siteconn.close
set siteconn= nothing
end if%>

OK, let's look at the code above and how it works.

In [ASP Classic], [GetRows] and [MoveNext] are methods for processing database recordsets with different performance profiles. [GetRows] dumps the entire recordset into a 2D array in memory, allowing for fast, disconnected processing. [MoveNext] iterates through the recordset row-by-row, keeping a live connection, which is memory-efficient but slower.

The array is presented by items from the Select statement.
I run a SQL Script that gives me, in order, a list of all the columns.
I then present them like this.

[Title]

CFFCS | CarrzSynEdit: | ASP/VBScript

' ColOne - 0

' ColTwo - 1

' Next, we create our Variables using the Array

strTID = arrTracks(0,Track)
strTrackName = arrTracks(1,Track)
' Then present it to the page as normal.

<%=strID%> | <%=strTrackName %>

The bottom code will throw out the data to your page a lot faster than the one in Example 2