SQL making me weep

[Randhart]

Hey all

I have a Small problem with my SQL statement, it sees my WHERE statements. But takes the condition as a coloumn name. it's suposed to check for a value in that coloumn and return the value of that row.
Here's my code:

****

Dim conn
Dim rsResults
Dim UserName
Dim PWD
Dim aConnect
Dim SQL

UserName = Request.Querystring("sUID")
PWD = Request.Querystring("sPWD")
aConnect = "Provider=SQLOLEDB.1;Persist Security Info=False;Data Source=DEV-SVR;Initial Catalog=Alchemy;User ID=Guest;Password=;ConnectionTimeout=10;"

Set conn = Server.CreateObject("ADODB.Connection")
Set rsResults = Server.CreateObject ("ADODB.Recordset")
conn.Mode = abModeReadWrite
conn.ConnectionString = aConnect
conn.open

Set rsResults = conn.Execute("SELECT User_PWD FROM Users WHERE User_UID = " & UserName & " ")

if PWD = rsResults("User_PWD") Then
Response.Write "UserID and Password Matches"
else
Response.Write "No matching Results"
end IF

rsResults.Close
conn.Close

********

Thanks in Advance

[bsmith]

You need to put a single quote before and after your UserName

Set rsResults = conn.Execute("SELECT User_PWD FROM Users WHERE User_UID = '" & UserName & "' ")