将用户输入放在sqlite中的select where语句中

Question

我正在尝试根据用户输入打印出搜索结果。这是我有库存的地方，我发表评论，以便更容易看到我认为我需要帮助的地方。我在Visual Studio 2012中使用C ++。

请问我的问题是使用select not insert。我可以使用insert进行参数化查询但是我在使用select和where时遇到问题。

#include <iostream>
#include <sqlite3.h>
#include <string>

using namespace std;

int main ()
{
    int rc, i, ncols;
    sqlite3 *db;
    sqlite3_stmt *stmt;
    char * sql;
    const char *tail;

    rc = sqlite3_open("test1.db", &db);
        if (rc) {
            fprintf(stderr, "Can't open database%s\n", sqlite3_errmsg(db));
            sqlite3_close(db);
            exit(1);
        } 
        /*
        string sql2 = "select * from User_Info;";
        rc = sqlite3_prepare_v2 (db,sql2.c_str(),-1,&stmt,&tail);

        The above whis is used when the integer used to quarry (sql2 in this case) is a string and 
        can also be rewritten as below when the integer used to quarry (sql in this case) is char.
        */
        string x;
        cin >> x;
        sql = "select * from User_Info where Middlename = '?';"; //Statement I would i would like to put user input in
        rc = sqlite3_prepare_v2 (db,sql,-1,&stmt,&tail);
        sqlite3_bind_text(stmt,x); // Not sure how this works
        if (rc != SQLITE_OK) {
            fprintf(stderr, "SQL error %s\n", sqlite3_errmsg(db));
        }
        rc = sqlite3_step(stmt);
        ncols = sqlite3_column_count(stmt);
        while (rc == SQLITE_ROW){
        for (i=0; i< ncols; i++) {
            fprintf(stderr, "%s\n", sqlite3_column_text(stmt,i));
        }
        fprintf(stderr, "\n");
        rc = sqlite3_step(stmt);
        }
    sqlite3_finalize(stmt);
    sqlite3_close(db);
    system("pause");
    return 0;
}

任何帮助都将不胜感激。