Your version wouldn't work w/o correction

lcSql = [SELECT User.* FROM User WHERE Usrname LIKE '] + tuUsrname + [']

It explicitly uses single quote as string literal delimiter which may or may not work with all backends.

>COMCodeBook uses this format for a user defined Get Function:
>

>  FUNCTION GetUserByUsrname( tuUsrname )
>    *-----------------------------------------------------
>    LOCAL loADO
>    loADO = THIS.GetADOAggregateParameter()
>    WITH loADO.oCommand
>      .ActiveConnection = loADO.oConnection
>
>      ***********************************
>      *----------------------------------
>      .CommandText = [ SELECT User.* FROM User WHERE Usrname LIKE ? ]
>      .PARAMETERS.APPEND(.CreateParameter( "Usrname", adChar, adParamInput, 18 ,tuUsrname ))
>      ***********************************
>    ENDWITH
>
>    THIS.ExecuteSQLQuery( loADO )
>    RETURN loADO.oRecordSet
>
>  ENDFUNC
>
>

>
>Why is the above more valuable than just doing:
>

>  FUNCTION GetUserByUsrname( tuUsrname )
>    *-----------------------------------------------------
>    LOCAL loADO, lcSql
>    loADO = THIS.GetADOAggregateParameter()
>    WITH loADO.oCommand
>      .ActiveConnection = loADO.oConnection
>
>      lcSql = 'SELECT User.* FROM User WHERE Usrname LIKE ' + tuUsrname
>      .CommandText = lcSql
>    ENDWITH
>
>    THIS.ExecuteSQLQuery( loADO )
>    RETURN loADO.oRecordSet
>
>  ENDFUNC
>
>