How to use ASP variables in SQL statement

<%
postit = request.querystring("thispost")
response.write(postit)
%> 

postit is the variable. The response.write works and this is all above the SQL statement below.

This is the SQL however when I add the postit variable I get this error message:

delCmd.CommandText="DELETE * FROM post WHERE (pos_ID = postit )"

Microsoft Access Database Engine error '80040e10'
No value given for one or more required parameters. 
/student/s0190204/wip/deleterecord.asp, line 32

Add a parameter to the SQL:

delCmd.CommandText="DELETE * FROM post WHERE (pos_ID = ?)"
delCmd.Parameters.Append delCmd.CreateParameter("posid", adInteger, adParamInput)   ' input parameter
delCmd.Parameters("posid").Value = postit

Couple of things that will help you in the future

1. Use Option Explicit to avoid hiding issues that will come back to bite you later on
2. Use ADODB.Command object, which is very versatile enabling to do a range of database calls, from simple dynamic SQL statements to Stored Procedures without the risk of SQL injection.

There are a few tips that can speed things up when using the ADODB.Command object in your code which will be demonstrated in the example below (assumes you already have a connection string stored in a global config call gs_connstr);

<%
Option Explicit

Dim postit
postit = Request.QueryString("thispost")
'Always do some basic validation of your Request variables
If Len(postit) > 0 And IsNumeric(postit) Then CLng(postit) Else postit = 0

Dim o_cmd, o_rs, a_rs, i_row, i_rows, l_affected
Dim SQL

'SQL statement to be executed. For CommandType adCmdText this can be any dynamic
'statement, but adCmdText also gives you an added bonus - Parameterised Queries
'instead of concatenating values into your SQL you can specify placeholders (?)
'that you will define values for that will get passed to the provider in the order
'they are defined in the SQL statement.
SQL = "DELETE * FROM post WHERE (pos_ID = ?)"

Set o_cmd = Server.CreateObject("ADODB.Command")
With o_cmd
  'ActiveConnection will accept a Connection String so there is no need
  'to instantiate a separate ADODB.Connection object the ADODB.Command object
  'will handle this and also open the connection ready.
  .ActiveConnection = gs_connstr
  .CommandType = adCmdText
  .CommandText = SQL
  'When using Parameters the most important thing to remember is the order you
  'appended your parameters to the Parameters collection as this will determine
  'the order in which they are applied to your SQL query at execution. Because
  'of this the name you give to your parameters is not important in terms of
  'execution but I find specifying a meaningful name is best (especially when
  'revisiting some code a few years down the line).
  Call .Parameters.Append(.CreateParameter("@pos_ID", adInteger, adParamInput, 4))
  'Parameter values can be passed in via the Execute() method using an Array
  'without having to define the parameter values explicitly. You can also specify
  'the records affected value to return number of rows affected by a DELETE,
  'INSERT or UPDATE statement.
  .Execute(l_affected, Array(postit))
End With
'Always tidy up after yourself, by releasing your object from memory, this will
'also tidy up your connection as it was created by the ADODB.Command object.
Set o_cmd = Nothing
%>

Here I'm trying to get the car_color of the car using the id of the car. Now I can use the car_color record set in my code. I would also recommend using CLng when passing in values, it'll prevent sql injections.

If the carID is not a number you'll get the following error:

"500 response from the server. Remember to open and close the sql connection."

Here is the code:

sql = "Select * from Cars Where ID = " & clng(carID)
    rs.open
    if not rs.eof then
      carID = rs("car_ID")
      carColor = rs("car_color")
    end if
    rs.close