title: How do I use parameters in VBA in the different contexts in Microsoft Access?
body: <p>I've read a lot about SQL injection, and using parameters, from sources like <a href="http://bobby-tables.com/" rel="noreferrer">bobby-tables.com</a>. However, I'm working with a complex application in Access, that has a lot of dynamic SQL with string concatenation in all sorts of places.</p>
  
  <p>It has the following things I want to change, and add parameters to, to avoid errors and allow me to handle names with single quotes, like Jack O'Connel.</p>
  
  <p>It uses:</p>
  
  <ul>
  <li><code>DoCmd.RunSQL</code> to execute SQL commands</li>
  <li>DAO recordsets</li>
  <li>ADODB recordsets</li>
  <li>Forms and reports, opened with <code>DoCmd.OpenForm</code> and <code>DoCmd.OpenReport</code>, using string concatenation in the <code>WhereCondition</code> argument</li>
  <li>Domain aggregates like <code>DLookUp</code> that use string concatenation</li>
  </ul>
  
  <p>The queries are mostly structured like this:</p>
  
  <pre><code>DoCmd.RunSQL "INSERT INTO Table1(Field1) SELECT Field1 FROM Table2 WHERE ID = " &amp; Me.SomeTextbox
  </code></pre>
  
  <p>What are my options to use parameters for these different kinds of queries?</p>
  
  <p><sub>This question is intended as a resource, for the frequent <em>how do I use parameters</em> comment on various posts</sub></p>