Q:

Multiple requests in URL rather than Recordset

I have the following recordset created in dreamweaver which looks for all machines which have the following cat_id's
<%
Dim rsTest
Dim rsTest_cmd
Dim Test_numRows

Set Test_cmd = Server.CreateObject ("ADODB.Command")
Test_cmd.ActiveConnection = MM_test_STRING
Test_cmd.CommandText = "SELECT *  FROM machinery  WHERE main_site='yes'    AND(Cat_id=13 OR Cat_id=14 OR Cat_id=15)  ORDER BY Make" 
Test_cmd.Prepared = true

Set Test = Test_cmd.Execute
Test_numRows = 0
%>

I'd like to have one page which would get the request via a URL request:
testpage.asp?=Cat_id=13&Cat_id=14&Cat_id=15

Dreamweaver only allows one filter and it sets the recodset request as follows:
<%
Dim rsTest
Dim rsTest_cmd
Dim rsTest_numRows

Set rsTest_cmd = Server.CreateObject ("ADODB.Command")
rsTest_cmd.ActiveConnection = MM_Test_STRING
rsTest_cmd.CommandText = "SELECT * FROM machinery WHERE main_site='yes' AND cat_id = ? ORDER BY cut_off ASC" 
rsTest_cmd.Prepared = true
rsTest_cmd.Parameters.Append rsTest_cmd.CreateParameter("param1", 5, 1, -1,  rsTest__MMColParam) ' adDouble

Set Test = rsv_cmd.Execute
rsv_numRows = 0
%>

What do I need to do at the recordset end of this problem, whenever I enter multiple requests in the URL string I get a page error of:
ADODB.Command error '800a0d5d'

Application uses a value of the wrong type for the current operation.

tespage.asp, line 19

Line 19 is;
rsTest_cmd.Parameters.Append rsTest_cmd.CreateParameter("param1", 5, 1, -1, rsTest__MMColParam) ' adDouble

Many thanks for taking the time to look

A:

I fear you must override DreamWeaver to get what you want by using raw SQL to put the values, so you lose to protection of using parameter. So you must sanitize the data yourself.
First, add this function to your code:
Function GetSafeArray(queryStringKey)
    Dim arrItems(), x, y
    Dim currentValue, blnExists
    ReDim arrItems(-1)
    For x=1 To Request.QueryString(queryStringKey).Count
        currentValue = Request.QueryString(queryStringKey).Item(x)
        If IsNumeric(currentValue) Then
            blnExists = False
            currentValue = CLng(currentValue)
            For y=0 To UBound(arrItems)
                If arrItems(y)=currentValue Then
                    blnExists = True
                    Exit For
                End If
            Next
            If Not(blnExists) Then
                ReDim Preserve arrItems(UBound(arrItems) + 1)
                arrItems(UBound(arrItems)) = currentValue
            End If
        End If
    Next
    GetSafeArray = arrItems
End Function

The function will return array containing only the integer values from the querystring, no dupes. SQL injection will fail as you can't hack anything with numbers alone.
Now to use the function in your case, have such code:
Dim arrSafeValues, strSafeValues
arrSafeValues = GetSafeArray("Cat_id")
strSafeValues = Join(arrSafeValues, ", ")
Erase arrSafeValues
If Len(strSafeValues)=0 Then
    Response.Write("Error: no valid values were given")
Else  
    Set Test_cmd = Server.CreateObject ("ADODB.Command")
    Test_cmd.ActiveConnection = MM_test_STRING
    Test_cmd.CommandText = "SELECT *  FROM machinery WHERE main_site='yes' AND Cat_id IN (" & strSafeValues & ") ORDER BY Make" 
    Test_cmd.Prepared = true
    Set Test = Test_cmd.Execute
    Test_numRows = 0
End If

