SQL命令是否异常

SQL命令是否错误?
要取得person表中ID为strName,Password为strPassword的记录:


CString   str,fh= " ";
str= "SELECT   *   FROM   person   WHERE   ID= "+fh+strName+fh+               "AND   Password= "+fh+strPassword+fh;
m_pCommand-> CommandText=str.AllocSysString();
m_pRecordset   =   m_pCommand-> Execute(&vNULL,&vNULL,adCmdText);

错误是无法读取数据库表记录

[解决办法]
str= "SELECT * FROM person WHERE ID= ' "+strName+ " ' AND Password ' "+strPassword+ " ' ";
??????