vb.net - getting variables into sql string from list box -

I'm trying to get the contents of a list box and the SQL string through a variable (moon). Select the 3 strings from the main body of the code given below. The last two strings work fine, but nobody does the first. This is where I try to variable the code and try to make some changes on the code but nothing seems to work. Does anyone have any suggestions on SQL:

  da = New AudiDiData adapter ("Choose from book * where [author] = '' & amp; Moon '', my connection) 'fails da = new audiadetta adapter ("Select from books", myConnection) 'works da = new Audiadetta adapter ("book Choose from * where author = 'Molly brown' ', my connection)' works' {code}  
 main code body  
  import system. Data import system Data.OleDb Import System.Data.Odbc Importing System.Data.DataTable as the String Dim Data File as String Dim Context as String Dim ConnString as String Dim Myconnection as OleDbConnection = New OleDbConnection Dim DS In DataSet = New Dataset Dim Da OleDbDataAdapter as Dim Table DataTableCollection = ds.Tables Dim Source 1 as new binding resource (Private) form 1_load (ByVal as the sender system. E.E.L. E. Aven Aarjijh) does MyBase handle. Lower Thumb Moon String = The List Box Text provider = "Provider = Microsoft. AEC. OLE DB.12.0; Data Source =" Datafile = "C: \ Documents and Settings \ james \ Desktop \ Author.accdb" 'ConnString = Provider & amp; dataFile myConnection.ConnectionString = connstring da = "Choose from books", select "Select from books, where [author] = '" & Moon and "'", my connection) 'fails' da = new Audiadetta adapter ("Select from books, , My connection) 'works' da = new selective adapter ("Select from books, where author = 'Molly brown' ', my connection)' works. Fill (DS," books ")" Replacement With the name "substituted 'replaced' item [item code], [ Description], [value] dim view with column header 1 as new data view (table (0)) source 1. datasource = view1 datagrid view 1. data source = view 1 datagrid view .1 refresh () ending sub end Class    
 
 
 The best practice is to use a new connection object for each call database It is possible to define objects small, and the value of your SQL string Using parameterized queries instead to replace somewhere to.  
  in any circumstances at any time a user selected VA changes in your SQL statement!  The code  is very bad:   
  da = new AudiDiData adapter ("Choose from book * where [author] = '" & Amp; Moon & amp; "" ", My Connection)   
 What will happen in this example if you have authors like"  Patrick O'Neill  "Your database, application And this problem can be further abused due to actual damage to users. Do not use string combinations for this.  
 Like this instead:  
  public class form 1 string = "provider = Microsoft as private provider Change the form of .ACE.OLEDB.12.0; Data Source = "Personal Conflict Datafile =" C: \ Documents and Settings \ james \ Desktop \ Author.accdb "'Changes to using the database space on your computer Private ConnString String = provider & amp; The datafile handles MyBase as Private Sub Forms 1_load (System.Object, ByVal E as System.EventArgs) as ByVal sender. Set a special placeholder for your value as part of a dim dsis () '* static * sql statement in the form of a new dataset, using the new OLEDbConnection (connString) as the DM SQL, using new OLEDB In the form of Commands (SQL, CN), select from String = "Select" as the new OLEDBETetApeter (CMD). Set the value for that placeholder To match your database, a query parameter 'parameter works best when you set the actual type and length' I had to imagine the length here. CMD.Pameters.Ad ("?", Oleadby Type.nature, 50). Value = Listbox 1 Text da Fill (DS, "Books") Using Datagrid View 1 Datasource = Databables ("Books") DataGride View 1. ) End Sub End Class