title: classic ASP protection against SQL injection
body: <p>I've inherited a large amount of Classic ASP code that is currently missing SQL injection protection, and I'm working on it. I've examined in detail the solutions offered here: <a href="https://stackoverflow.com/questions/149848/classic-asp-sql-injection-protection">Classic ASP SQL Injection Protection</a>
  On the database side, I have a Microsoft SQL server 2000 SP4</p>
  
  <p>Unfortunately stored procedures are not an option.</p>
  
  <p>After studying php's mysql_real_escape_string ( <a href="http://www.w3schools.com/php/func_mysql_real_escape_string.asp" rel="nofollow noreferrer">http://www.w3schools.com/php/func_mysql_real_escape_string.asp</a> ) , I've replicated its functionality in ASP.</p>
  
  <p>My question(s) are:</p>
  
  <p>1) Does Microsoft SQL server 2000 have any other special characters that need to be escaped that are not present in MySQL ( \x00 , \n , \r , \ , ' , " ,  \x1a )</p>
  
  <p>2) From an answer in <a href="https://stackoverflow.com/questions/139199/can-i-protect-against-sql-injection-by-escaping-single-quote-and-surrounding-use">Can I protect against SQL Injection by escaping single-quote and surrounding user input with single-quotes?</a>  I read "One way to launch an attack on the 'quote the argument' procedure is with string truncation. According to MSDN, in SQL Server 2000 SP4 (and SQL Server 2005 SP1), a too long string will be quietly truncated."</p>
  
  <p>How can this be used for an attack (I really can't imagine such a scenario) and what would be the right way of protecting against it?</p>
  
  <p>3) Are there any other issues I should be aware of? Any other way of injecting SQL?</p>
  
  <p>Note: A 30-min internet search said that there are no libraries for classic ASP to protect against SQL injection. Is this so, or did I really fail at a basic task of searching?</p>