Microsoft OLE DB Provider for SQL Server error '80040e14' Incorrect syntax near '='

问题

I get this error when i try to retrieve the data from database using the following piece of code.

Can someone help?

set rs = Server.CreateObject("ADODB.recordset")
sql = " SELECT * from COMPANY WHERE COMPANY_ID = " & Request.Form("CompanyId")
rs.Open sql, cnn

回答1:

First of all, this is bad practice to do ad-hoc queries without using parameters. SQL Injection attack info: http://en.wikipedia.org/wiki/SQL_injection

To answer the question, though, you need to have single quotes around your varchar or char value that you are searching for.

set rs = Server.CreateObject("ADODB.recordset")
sql = " SELECT * from COMPANY WHERE COMPANY_ID = '" & Request.Form("CompanyId") & "'"
rs.Open sql, cnn

来源：https://stackoverflow.com/questions/26750894/microsoft-ole-db-provider-for-sql-server-error-80040e14-incorrect-syntax-near