asp classic - How to use named parameters / named prepared statements with Postgres and ADODB -

i cleaning legacy asp-vba code talks postgres database (8.2) on adodb. @ moment it's using string building sql statements , i'd use prepared statements avoid sql injection.

i cannot work out how named variable. i've succeeded in doing "?" operator , adding parameters in order defined in sql. no in situation[1].

i have been able simple simple parameter replacement using ? operator , createparameter(...):

var ocmd = server.createobject("adodb.command"); ocmd.commandtext = "select * sometable somefield = ? , = ?"; ocmd.parameters.append ocmd.createparameter("", advarchar, adparaminput, 50, "val1") ocmd.parameters.append ocmd.createparameter("", advarchar, adparaminput, 50, "val2") 

but if attempt names does not work:

var ocmd = server.createobject("adodb.command"); ocmd.commandtext = "select * sometable somefield = @a , = @b"; ocmd.parameters.append ocmd.createparameter("@b", advarchar, adparaminput, 50, "val2") ocmd.parameters.append ocmd.createparameter("@a", advarchar, adparaminput, 50, "val1") 

i see notes saying might failing of odbc (http://www.codeproject.com/tips/231217/parameters-sqlcommand-vs-oledbcommand-and-odbccomm). know way around or other option?

[1] unfortunately cannot use ? ? ? , define parameters in order. code wrapped in legacy orm sub values in out of order. if can send them name can cleanly.

any or pointers appreciated.

i once had modify postgres driver of adodb (release 2004) make capable of handing both parameters , using of regular expressions in postgres statements. problem using "?" question character interpreted parameter. modified postgres 7 driver on _query method, changing line 151 as:

$sqlarr = explode(' ?',trim($sql));  

just adding space before question mark. ' ?' replaced driver $1, $2, etc., so, may anticipate replacement sending named parameters $1, $2 instead of "?".

abrazo