Seguridad con el String SQL

[Saruman]

que va... lo probe de nuevo y nada...

Código:

Public Function UserLogin(m_user_name, m_user_password)
  if m_user_name <> "" then
   conectar = "Provider=sqloledb;" & _ 
	   "Data Source=" & strDBPath & ";" & _
	   "Persist Security Info=False;Trusted_Connection=false;" & _
	   "Initial Catalog=" & strDBName & ";" & _
	   "User Id=" & strDBUserId & ";" & _
	   "Password=" & strDBPassword
   Set ObjConn = Server.CreateObject("ADODB.Connection")
   Set rs = Server.CreateObject("ADODB.Recordset")
   Set cmd = Server.CreateObject("ADODB.Command")
   ObjConn.Open conectar
   qry = "select * from usuario where usuario= ? and clave= ? "
   Set param = cmd.CreateParameter("usuario", adVarChar, adParamInput, 12, m_user_name)
   cmd.Parameters.Append(param)
   Set param = cmd.CreateParameter("clave", adVarChar, adParamInput, 128, m_user_password)
   cmd.Parameters.Append(param)
   cmd.ActiveConnection = ObjConn
   cmd.CommandText = qry
   cmd.CommandType = adCmdText
   rs.CursorType = 3
   rs.Open cmd
   if rs.bof=false and rs.eof=false then
	strTemp = "conectó bien"
   else
	strTemp = "no conectó"
   end if
  else
   strTemp = ""
  end if
  Set rs = Nothing
  ObjConn.Close
  Set ObjConn = Nothing
  Set cmd = Nothing
  Set param = Nothing
  
  UserLogin = strTemp
 End Function

Código:

 xx = UserLogin(usuario, password)

las funcion de coneccion está arriba....
gracias de nuevo