ADO 2.8 was included in Windows XP and Windows Server 2003, as part of the Microsoft Data Access Components (MDAC) 2.8. A redistributable version of MDAC 2.8 is also available; note that this redistributable version should only be installed on Windows 2000. ADO 2.8 addresses several security-related concerns:
Hard drive access is not allowed outside a trusted zone.
In cross-domain scripting involving nontrusted sites, the following operations are disabled: Stream.SaveToFile, Stream.LoadFromFile, Recordset.Save, and Recordset.Open, used in conjunction with the adCmdFile flag or with the Microsoft OLE DB Persistence Provider (MSPersist).
Recordset.Open, Recordset.Save, Stream.SaveToFile, and Stream.LoadFromFile operate on physical files only.
These methods now verify that file handles point to physical files only.
Recordset.ActiveCommand returns an error when invoked from an HTML/ASP page.
This prevents the Command object from being misused.
The number of Recordsets returned by a nested Shape command has an upper bound.
A nested shape command now returns a maximum of 512 Recordsets. This means that a Shape command can no longer be nested at any depth. Instead, the maximum level depth is 512, if each command results in a single (child) Recordset. If, at any level, a Shape command returns multiple Recordsets, the maximum level of depth will be less than 512.
The Command object supports commands in stream format as an alternative to using the CommandText property. The CommandStream property (ADO) can be used to specify XML Templates or updategrams as the Command input with the Microsoft OLE DB Provider for SQL Server.
Dialect is a new property that defines the syntax and general rules that the provider uses to parse the string or stream.
The Execute method of the ADO Command object has been enhanced to use streams for input and output.
If the user encounters a DB_E_ERRORSOCCURRED error when modifying a Field of a Recordset, ADO will now fill the Field.Status property with the appropriate status information so that the user will have more information about what went wrong. See Status Property (ADO Field).
NamedParameters is a new property of the Command object that indicates that the provider should use named parameters.
Resultsets in streams
ADO can return resultsets from a data source in a Stream, rather than a Recordset object. Using the latest version of the Microsoft OLE DB Provider for SQL Server, you can get XML results from the provider by executing a "For XML" query. A Stream that receives the resultset can be opened with a "For XML" command as the source. See Retrieving Resultsets into Streams.
Single row resultset
The ADO Record object can now be opened on a command string or Command object that returns one row of data from the provider. This results in improved performance with MDAC 2.6 providers. See Open Method (ADO Record).
ADO 2.5 introduces the Record object to represent and manage a row from a Recordset or a data provider, or an object encapsulating a semi-structured data, such as a file or directory.
ADO 2.5 also introduces the Stream object to represent a stream of binary or text data.
ADO 2.5 introduces the use of a URL, as an alternative to a connection string and command text, to name data store objects. A URL can be used with the existing Connection and Recordset objects, as well as with the new Record and Stream objects.
Data providers supporting URL binding
ADO 2.5 supports OLE DB providers that recognize the URL schemes. This includes OLE DB Provider for Internet Publishing, which accesses the Windows 2000 file system and recognizes the existing HTTP scheme.