Why the Inline INSERT Fails
The script creates an ADODB.Command but never assigns Connection to DBCommand.ActiveConnection. Bind the command to the connection before execution. The reported errors also show that neither inline marker is being bound as intended: SQL interprets @Comm as an undeclared scalar variable, while the provider treats ? as a required parameter without a supplied value.
| Marker | Reported error | Diagnostic meaning |
|---|---|---|
@Comm |
Must declare the scalar variable "@Com" |
The database received an unresolved variable. The evidence contains @Comm in the query but @Com in the error; verify the exact spelling in the running script and full error text. |
? |
No Value given for one or more required parameters |
The command did not associate the appended value with the required placeholder. |
Use the Evidence-Supported Stored Procedure Pattern
The demonstrated working approach places the parameterized INSERT in a database stored procedure. The WinCC VBScript then binds the existing connection, selects the stored procedure, sets CommandType to 4, assigns its named parameters, and executes it.
Set command = CreateObject("ADODB.Command")
Set command.ActiveConnection = Connection
command.CommandText = "sp0001_ExampleStoredProcedure"
command.CommandType = 4
command.Parameters("@Parameter1") = "parameterValue"
command.Parameters("@Parameter2") = "parameterValue"
command.ExecuteParameterize Every Textbox-Sourced Value
Moving only WinCC_Comment.Value into a parameter does not remove every SQL-injection path. The original INSERT still concatenates WorkID and User.Value into sqlString. Define stored-procedure inputs for every runtime value, including the work ID, comment, and user value; keep GetDate() inside the database statement if database time is required.
The original comment parameter specifies adVarChar, input direction, and a length of 255. Preserve that length only if it matches the stored-procedure parameter and the Comment column. Otherwise, align all three definitions rather than silently truncating or rejecting the value.
Verify the Command Path
- Confirm that
GetDBConnection("Test")returns an open connection, then assign it tocommand.ActiveConnection. - Confirm that the stored-procedure name and each parameter name exactly match the database definitions.
- Execute with a comment containing an apostrophe and verify that the complete text is inserted as data, not interpreted as SQL syntax.
- Verify the inserted work ID, comment, database-generated time, and writer value in
WorkCommentLog.
DBRecordSet is created in the original script but is not used for this INSERT. It is not required by the demonstrated command-execution pattern.
FAQ
Why does WinCC report “Must declare the scalar variable” for @Comm?
The database is receiving @Comm as an unresolved SQL variable instead of a bound command parameter. Bind ActiveConnection and use the demonstrated stored-procedure parameter pattern; also check the @Comm/@Com spelling discrepancy.
Why does an ADO question-mark parameter report no value?
The provider did not associate the appended parameter with the ? placeholder. The evidence-supported workaround is to move the INSERT into a stored procedure and assign its named parameters through command.Parameters.
Is parameterizing only the WinCC comment textbox sufficient?
No. The shown script still concatenates WorkID and User.Value; pass every runtime value as a stored-procedure parameter and verify that the comment definition matches the stated 255-character length.