ASP Classic VBscript Parameterized SQL Query

parameterized_sql_query.asp

<%
  Dim CONN
  Set CONN = server.CreateObject("ADODB.Connection")
  CONN.Open connstr
	
  Dim CMD
  set CMD = server.CreateObject("ADODB.Command")

  set CMD.ActiveConnection = CONN
  
  sql = "SELECT * FROM table WHERE name=? OR field LIKE ?"

  CMD.Parameters.Append CMD.CreateParameter("@p1", 200, 1, 200, nameVar)
  CMD.Parameters.Append CMD.CreateParameter("@p2", 200, 1, 200, "%" + fieldVar + "%")
  
  CMD.CommandType = 1
  CMD.CommandText = sql

  Set recordset = server.CreateObject("ADODB.Recordset")
  recordset.CursorType = 3
  recordset.CursorLocation = 3
  recordset.Open CMD,, adOpenStatic
  
  totalRecords = recordset.RecordCount

  ...