DW 8 Patch - Recordset Code Change

Question

Hi All...
I've just updated my DW 8.0 to 8.0.2 due to the recent SQL Injection attacks.
Some of my recordsets are complex and i'm having trouble updating one in particilar.
I've posted the old code and the new code below.
I can see that the problem is caused in the SQL Select Statement code that the new patch creates   'Where RelatedProductID=?"
I'm hoping someone can offer a solution before i pull all my hair out :-)
Fingers crossed and thanks in advance
Andy
Here is the SQL Statement i put in to DW - problem highlighted in red
SELECT RelatedProducts.ProductID, Products.Product  FROM RelatedProducts INNER JOIN Products ON RelatedProducts.ProductID = Products.ProductID  where RelatedProductID=param  UNION  SELECT RelatedProducts.RelatedProductID, Products.Product
FROM RelatedProducts INNER JOIN Products ON RelatedProducts.RelatedProductID = Products.ProductID
WHERE RelatedProducts.ProductID=param
ORDER BY Product
and the page code generated:
<%
Dim RelatedProductsRS__param
RelatedProductsRS__param = "1"
If (ProductID   <> "") Then
  RelatedProductsRS__param = ProductID 
End If
%>
<%
Dim RelatedProductsRS
Dim RelatedProductsRS_cmd
Dim RelatedProductsRS_numRows
Set RelatedProductsRS_cmd = Server.CreateObject ("ADODB.Command")
RelatedProductsRS_cmd.ActiveConnection = MM_my_STRING
RelatedProductsRS_cmd.CommandText = "SELECT RelatedProducts.ProductID, Products.Product  FROM RelatedProducts INNER JOIN Products ON RelatedProducts.ProductID = Products.ProductID  where RelatedProductID=? UNION  SELECT RelatedProducts.RelatedProductID, Products.Product FROM RelatedProducts INNER JOIN Products ON RelatedProducts.RelatedProductID = Products.ProductID WHERE RelatedProducts.ProductID=param ORDER BY Product"
RelatedProductsRS_cmd.Prepared = true
RelatedProductsRS_cmd.Parameters.Append RelatedProductsRS_cmd.CreateParameter("param1", 5, 1, -1, RelatedProductsRS__param) ' adDouble
Set RelatedProductsRS = RelatedProductsRS_cmd.Execute
RelatedProductsRS_numRows = 0
%>
Old SQL statement before the patch - old code highlighted in red
<%
Dim RelatedProductsRS__param1
RelatedProductsRS__param1 = "1"
If (ProductID  <> "") Then
  RelatedProductsRS__param1 = ProductID
End If
%>
<%
Dim RelatedProductsRS
Dim RelatedProductsRS_numRows
Set RelatedProductsRS = Server.CreateObject("ADODB.Recordset")
RelatedProductsRS.ActiveConnection = MM_my_STRING
RelatedProductsRS.Source = "SELECT RelatedProducts.ProductID, Products.Product  FROM RelatedProducts INNER JOIN Products ON RelatedProducts.ProductID = Products.ProductID  where RelatedProductID=" + Replace(RelatedProductsRS__param1, "'", "''") + "  UNION  SELECT RelatedProducts.RelatedProductID, Products.Product  FROM RelatedProducts INNER JOIN Products ON RelatedProducts.RelatedProductID = Products.ProductID  WHERE RelatedProducts.ProductID=" + Replace(RelatedProductsRS__param1, "'", "''") + "  ORDER BY Product"
RelatedProductsRS.CursorType = 0
RelatedProductsRS.CursorLocation = 2
RelatedProductsRS.LockType = 1
RelatedProductsRS.Open()
RelatedProductsRS_numRows = 0
%>

Answer 1

Hi bregent
Thank you for responding to my post.
With a fresh pair of eyes on me this morning, i managed to sort the problem out.
I simply removed the param's in the DW Recordset Bindings and re-added them using a separate param for each instance the param was called in the SQL Statement.
All working fine now :-D
I have a new problem on the product insert page - please see my latest post if you could possibly help!
Thanks Again
So now the generated code looks like:
<%
Dim RelatedProductsRS__param
RelatedProductsRS__param = "1"
If (ProductID   <> "") Then
  RelatedProductsRS__param = ProductID 
End If
%>
<%
Dim RelatedProductsRS__param2
RelatedProductsRS__param2 = "1"
If (ProductID <> "") Then
  RelatedProductsRS__param2 = ProductID
End If
%>
<%
Dim RelatedProductsRS
Dim RelatedProductsRS_cmd
Dim RelatedProductsRS_numRows
Set RelatedProductsRS_cmd = Server.CreateObject ("ADODB.Command")
RelatedProductsRS_cmd.ActiveConnection = MM_myconnection_STRING
RelatedProductsRS_cmd.CommandText = "SELECT RelatedProducts.ProductID, Products.Product  FROM RelatedProducts INNER JOIN Products ON RelatedProducts.ProductID = Products.ProductID  where RelatedProductID=? UNION  SELECT RelatedProducts.RelatedProductID, Products.Product FROM RelatedProducts INNER JOIN Products ON RelatedProducts.RelatedProductID = Products.ProductID WHERE RelatedProducts.ProductID=? ORDER BY Product"
RelatedProductsRS_cmd.Prepared = true
RelatedProductsRS_cmd.Parameters.Append RelatedProductsRS_cmd.CreateParameter("param1", 5, 1, -1, RelatedProductsRS__param) ' adDouble
RelatedProductsRS_cmd.Parameters.Append RelatedProductsRS_cmd.CreateParameter("param2", 5, 1, -1, RelatedProductsRS__param2) ' adDouble
Set RelatedProductsRS = RelatedProductsRS_cmd.Execute
RelatedProductsRS_numRows = 0
%>