How should I use INSERT INTO with a MS Access .mdb database? - sql

Question

This is a work project but I'm having trouble getting my head around using "insert into" for an MS Access DB.
I've tried the following 3 scripts and all return different errors and of course I want my initial problem resolved but I would also appreciate knowing why they are all failing and what's different/best practice. These scripts are all modified ones I've found from searching around:
Script1:
Const adOpenStatic = 3
Const adLockOptimistic = 3
Set objConnection = CreateObject("ADODB.Connection")
Set objRecordSet = CreateObject("ADODB.Recordset")
objConnection.Open _
"Provider = Microsoft.Jet.OLEDB.4.0; " & _
"Data Source = C:\Users\itsupport\Documents\test.mdb"
objRecordSet.Open _
"INSERT INTO Users" & _
"(Id, Name, " & _
"CertificateName, Password) " & _
"VALUES ('michaelr', 'Michael Raymond', " & _
"'NULL', '888')", _
objConnection, adOpenStatic, _
adLockOptimistic
Error 1:
Syntax error in INSERT INTO statement
Script 2:
Set objConn = CreateObject("ADODB.Connection")
Dim rsData
strConnection = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source='C:\Users\itsupport\Documents\test.mdb'"
objConn.Open strConnection
strInsertSQL = "INSERT INTO Users (iD,Name,CertificateName,Password) VALUES('" & _
michaelr & "','" & Michael Jenkins & "','" & - & "','" & 888 & "', objConnection, adOpenStatic, adLockOptimistic);"
Set rsData = objConn.Execute(strInsertSQL)
Error 2:
Expected end of statement
Script 3:
sql1="INSERT INTO Users VALUES ('michaelr','Michael Jenkins',NULL,'888')"
constring="Provider=Microsoft.Jet.OLEDB.4.0;
Data Source=C:\Users\itsupport\Documents\test.mdb;
User Id=admin;Password=;"
set con=createobject("adodb.connection")
con.open constring
con.execute sql1
con.close
Error 3:
Unterminated string constant

Answer 1

Script1:
Defining the ad* constants is necessary in plain VBScript (there are no libraries to be referenced)
Non-trivial concatenated strings should be assigned to a variable and displayed for visual inspection
INSERT INTO Users(Id, Name, CertificateName, Password) VALUES ('michaelr', 'Michael Raymond', 'NULL', '888') quotes NULL and uses the reserved word "Password" (see here)
Script 2:
The concatenation 'works' if you double quote michaelr, Michael Jenkins, and - (whatever that means)
String concatenation in VBScript is a mess; unnecessary concatenation should be avoid (as in Script 3)
Script 3:
The syntax error is caused by the bad quoting and missing & _ in the definition of constring (you did it correctly in Script 1)
In general:
A lot of problems of building (and safely using) SQL statements simply vanish if you use parameterized queries
String concatenation in VBScript is a mess; using Arrays and Join, dedicated quote functions, and replacement of placeholders (no variable interpolation/expansion here) will result in better code