asp.net 下from子句语法错误!

string sql = "select * from user where username = '" +username+ "' and password='" +password+ "'";
OleDbConnection conn = new OleDbConnection();
conn.ConnectionString = "Provider = Microsoft.Jet.OLEDB.4.0;Data Source= "+Server.MapPath("userinfo.mdb");
conn.Open();
OleDbCommand comm = new OleDbCommand(sql,conn);
OleDbDataReader dr = comm.ExecuteReader();

关键代码如上!!希望有朋友能帮我解决下!!!我检查了很多遍!!但是都不能发现错误在哪!!!

补充：那位哥们!在C#下面定义变量是用+不是用&
		

答案：
 user 这个表最好改一名，因为系统有个表也是这个名，如果用到时，要加中括号，如下
string sql = "select * from [user] where username = '" +username+ "' and password='" +password+ "'";
你把加号都改成 & 试试