关于'"'"和&的有关问题

关于'"'"和&的问题
<%
if country<>"" then
  sql="SELECT Companyname,Contactname,Country FROM Customers WHERE country='" & country & "'"
  set rs=Server.CreateObject("ADODB.Recordset")
  rs.Open sql,conn
%>

上个'" & country & "'"中的country是由request.form传的参数（country=request.form（"country"））

[解决办法]

HTML code

增加函数function Do_add(table,direct)set rs=server.createobject("adodb.recordset")sql="select * from "&table&" where (id is null)" rs.open sql,conn,1,3rs.addnewfor i= 1 to rs.fields.count-1rs(i)=request(rs(i).name)nextrs.updaters.closeset rs=nothingconn.closeset conn=nothingresponse.Redirect directend function