Using NT login as part of SQL query run via VBA in Access 2007

Question

In Access 2007, I'm trying to use the NTlogin to retrieve a value from a table via a SQL query (see code below). WHen the form loads, I get an error message saying "Compile Error: Expected Function or Variable". Can someone tell me how to fix this error.

Private Sub Form_Load()

    Dim UserName As String
    Dim strSQL As String
    Dim strDept As String

    UserName = Environ("USERNAME")

    strSQL = "SELECT DEPT FROM IDs WHERE NTLOGIN =" & UserName

    strDept = DoCmd.RunSQL(strSQL)

    cmdSave.Enabled = False
    cmdEdit.Enabled = True
    cmdPrevious.Enabled = True
    cmdNext.Enabled = True

End Sub

Answer 1

I haven't touched Access for some time, so I don't recall: is Environ("USERNAME") returning the USERNAME environment variable?

If so, then you have a security hole in your code. Specifically, you're open to a SQL Injection attack.

Imagine that before they run Access, a user sets the USERNAME environment variable to something like

''; DROP TABLE IDS;

In that case, you'll be executing the statement:

SELECT DEPT FROM IDs WHERE NTLOGIN =''; DROP TABLE IDS;

You may not want that to happen...

Answer 2

You cannot use RunSQL with a select statement. It is only for action queries.

If you want a recordset, you can say, amongst other things:

strSQL = "SELECT DEPT FROM IDs WHERE NTLOGIN ='" & UserName & "'"
Set rs=CurrentDB.OpenRecordset(strSQL)

Where rs is DAO.Recordset