在将值发送到参数化查询之前，我应该转义单引号吗？

Question

I was told (or read somewhere) that when you use parameterized queries (eg with an ADODB.Command object), all of the escaping is handled internally either within the Command object or within the database engine.

Is this true?

An Example of my command code is below - is it safe to pass a raw parameter as with the first parameter created, or should it be escaped as with the second parameter?

My specific environment is vbscript on windows 2008 (or newer) and SQL Server 2008 (or newer).

Dim oSproc : Set oSproc = CreateObject("ADODB.Command") 
With oSproc
    .ActiveConnection = oConn
    .CommandText = "mysp_SPNAME"
    .CommandType = adCmdStoredProc 
    With .Parameters
        .Append oSproc.CreateParameter("@IN_str1", adVarChar, adParamInput, 255, myStr)
        .Append oSproc.CreateParameter("@IN_str2", adVarChar, adParamInput, 255, replace(myStr, "'", "''"))
    End With 
    .Execute 
End With 

Answer 1

Its true; parametrization is done by the Command object when you use it in conjunction with Parameter objects.

You can verify this by passing "'" and observing there is no error, or by running a trace and looking at the sp_executeSQL call.