Various ways.
The best way is to not even include the condition in the SQL if it's not specified.
For example:
Code:
SQL = "SELECT * FROM INCIDENTS WHERE 1=1 "
If department <> "" Then
SQL = SQL & " AND H#DEPT1 = '" & Replace(department,"'","''") & "' "
End If
If username <> "" Then
SQL = SQL & " AND H#USERNAME1 = '" & Replace(username,"'","''") & "' "
End If