代码:
--------------------------------------------------------------------------------
Dim sql
sql = "SELECT * FROM Users WHERE UserName = '" & userName & "'"
--------------------------------------------------------------------------------
以上代码中,如果字符串变量 userName 中含有“'”单引号,则会报错。我们必须手工转化:
代码:
--------------------------------------------------------------------------------
Dim sql
sql = "SELECT * FROM Users WHERE UserName = '" & Replace(userName, "'", "''")
& "'" '转化为连续两个单引号
--------------------------------------------------------------------------------
而使用带参数查询,我们的 SQL 语句可以写为:
代码:
--------------------------------------------------------------------------------
Dim sql
sql = "SELECT * FROM Users WHERE UserName = @userName"
--------------------------------------------------------------------------------
代码:
--------------------------------------------------------------------------------
select * from Users where UserName = p_UserName and BookTitle = p_bookTitle
--------------------------------------------------------------------------------