When to add single quotation marks and when to add double quotation marks to SQL statements in ASP

select * from users where useraccount=" + "'" + username + "'" + "and userpwd=" + "'" + strmd5 + "'"

select * from users where useraccount='username1' and userpwd='md5pwd'

This is a SQL statement translated from C, where single quotes indicate the use of character classes in the database, such as Id Like'aaa001', double quotation marks indicate the string inside c. It is recommended to use like instead of = for comparison of character classes in the database

select * from users where useraccount like 'username1' and userpwd like 'md5pwd'(Look for the user name in the user table.)"username1"And the ciphertext after MD5 encryption is"md5pwd", if present, indicates that the user's username is consistent with the password and allows the user to log in to the system.

Characters and strings should be in single quotation marks followed by double quotation marks, and integers and floating-point numbers should be in double quotation marks.

This starts with the role of double quotation marks and single quotation marks

1. The fields in the double quotation marks will be interpreted by the compiler and then output as html**, but the fields in the single quotation marks do not need to be explained, and they are output directly. For example:

abc='i love u';

The echo $abc result is: I love u

echo '$abc'The result: $abc

echo "$abc"The result is: i love u

2, so when assigning the SQL statement in the database, it should also be used in double quotation marks sql="select a,b,c from .."

3, but there will be single quotation marks in the SQL statement to enclose the field name.

For example: select * from table where user='abc';

The SQL statement can be written as sql="select * from table where user='abc'"

4, but if like the following:

user='abc';

sql1="select * from table where user=' ".$user." ' ";Contrast.

sql2="select * from table where user=' abc ' "

5. I added a little more space between single quotation marks and double quotation marks, I hope you can see it clearly.

That is, to put'abc'Replace with'".$user."'It's all in a single quote. It's just that the whole SQL string is split.

sql1 can be broken down into the following three parts:

1："select * from table where user=' "

2：$user

Use ato connect.

If the content of the string in the single quotation marks needs to be escaped, it may be necessary to add single quotation marks for escape, which needs to be analyzed.

Pairs of double quotation marks represent objects, and some objects with special characters need to be enlarged with double quotation marks when naming and referencing, for example, a table name needs to be named Table 1 (with a space in the middle), then it needs to be written during the naming and citation process"Table 1", which is essentially equivalent to [Table 1].

In SQL, characters are enclosed in double quotation marks, and only in the table name that is more special, such as a two-word table name, is enclosed in double quotation marks. 'Used to delimit strings,"Used to delimit identifiers.

In the example you gave, it's exactly a two-word table name or column name.