Question

strsql1="select * from manager where name=" & username 这句是否有错？为什么列名 'he' 无效？

<%
response.Buffer=true
dim db
Set db=Server.CreateObject("ADODB.Connection")
db.open "PROVIDER=SQLOLEDB;DATA SOURCE=(local);UID=sa;PWD=;DATABASE=data"
'response.Write db.state

dim usertype,username,password
usertype=request.Form("type")
username=request.Form("name")
password=request.Form("password")
session("name")=username
'response.Write usertype

if usertype="manager" then

dim strsql1,rs1
set rs1=server.CreateObject("ADODB.recordset")
strsql1="select * from manager where name=" & username
rs1.open strsql1,db,1
'response.Write rs1.recordcount
if rs1.recordcount<=0 then
%>
error
<%
else
%>
<a href="manager.asp">点击进入主页面</a>
<%
end if
...........

Answer 1

加上单引号，即：
strsql1="select * from manager where name=‘" & username & “’”