Seguridad con el String SQL

[u_goldman]

Esta es una funcion que estoy utilizando dentro de una clase para autentificar a mis usuarios, la parte de parametrizacion viene en negritas, si lo adaptas y tratas de mandarle strings de SQL veras lo que pasa.

Código:

	Public Function UserLogin()
		if m_user_name <> "" then
			Dim ObjConn
			Dim cmd
			Dim param
			Dim rs
			Dim qry
			Dim strTemp
			Set ObjConn = Server.CreateObject("ADODB.Connection")
			Set rs = Server.CreateObject("ADODB.Recordset")
			Set cmd = Server.CreateObject("ADODB.Command")
			ObjConn.Open strConnect
			qry = "SELECT a.*, b.iGroup_id FROM tbl_iGroup_user a INNER JOIN xref_iGroup_user b " & _
			" ON a.iGroup_user_id = b.iGroup_user_id WHERE a.iGroup_user_email = ? AND " & _
			" a.iGroup_user_password = ? AND a.iGroup_user_active = 1 "
			Set param = cmd.CreateParameter("user_name", adVarChar, adParamInput, 200, m_user_name)
			cmd.Parameters.Append(param)
			Set param = cmd.CreateParameter("user_password", adVarChar, adParamInput, 20, m_user_password)
			cmd.Parameters.Append(param)
			cmd.ActiveConnection = ObjConn
			cmd.CommandText = qry
			cmd.CommandType = adCmdText
			rs.CursorType = 3
			rs.Open cmd
			if not rs.EOF then
				session("user_privateID") = rs(0)
				strTemp = ""
				while not rs.EOF
					strTemp = strTemp & rs("iGroup_id") & ","
					rs.MoveNext
				wend
				strTemp = left(strTemp, len(strTemp) - 1)
			else
				strTemp = ""
			end if
		else
			strTemp = ""
		end if
		Set rs = Nothing
		ObjConn.Close
		Set ObjConn = Nothing
		Set cmd = Nothing
		Set param = Nothing
		UserLogin = strTemp
	End Function

Salu2,