I have a very simple Access query stored in my database. Its only confirms the user name and first address line. It is working fine in access but it is not working from asp if I am entering any value starting with number in form.

here is my code

stored query:
SELECT customer.*
FROM customer
WHERE ((customer.c_surname=customersurname) And (customer.c_pcode=customerpostcode) and (customer.c_add1=[customeradd]));

and here is the asp code:



<%
    set rslogin = server.createobject("ADODB.recordset")

    customersurname=request.form("customer_surname")
    customeradd=trim(cstr(request.form("customer_add") ))
    customerpostcode=request.form("customer_postcode")

    makeConnection("data/villa.mdb")

    if customersurname="" or customeradd="" or customerpostcode="" then
            Session("loginerrormsg")=" Customer details are empty. Please try again."
            response.redirect("default.asp")
    else

        sql="exec getcustomerLoginInfo "&customersurname&","&customerpostcode&","&custome radd

        rslogin.open sql, ConnVilla
        if rslogin.eof or rslogin.bof then
            Session("loginerrormsg")=" User name or password is not correct. Please contact administrator."
            response.redirect("default.asp")
        else
            Session("loginerrormsg")=" Welcome!.."
            session("logged")="some one logged in"
            session("user_name")=rslogin("c_name")&" "&rslogin("c_surname")
            session("login_type")=""
            Response.Redirect("default.asp")
        end if
        closeConnection
    end if

%>

and here id the error I am getting:

Microsoft OLE DB Provider for ODBC Drivers (0x80040E14)
[Microsoft][ODBC Microsoft Access Driver] Syntax error (missing operator) in query expression '324wed'.

if I enter '324wed' or anything starting with number in to any field in my form I am getting the error above.

Would you please help me.