help me with " sign in display of data in asp form

C

cooldv

i know how to replace the sign " when SUBMITTING a form in asp by this
code:
message = Replace(usermessage, "'", "''").

My problem is DISPLAYING data in an asp FORM, from an an access
database, when the data already contains a " sign

problem is like this:
access database .... to update on the internet .... a *dataupdate.asp*
page ..... On this page, the data gets displayed in a form where i
make corrections and then i update it ..... working perfectly; the
data gets displayed in the form perfectly well and gets updated alsoIf there is a " sign in the data, then all the text beyond the " sign
is not displayed inside the text box of the form and is obviously lost
if the form is submitted to update the database.

Also, if data is like this:
text1 " text2 > text3 text4

then,
text1 is displayed inside the text box of the form
text2 is not displayed anywhere as it is after the sign "
the data beyond the > sign gets displayed, but
text3 text4 get displayed OUTSIDE the text box of the form as html
output


Here is the code:

<%
Actionvar=Request.QueryString("actionvar")

Set conn = server.createobject("adodb.connection")
DSNtemp="DRIVER={Microsoft Access Driver (*.mdb)}; "
DSNtemp=dsntemp & "DBQ=" & server.mappath("database.mdb")
conn.Open DSNtemp

IF Actionvar="update" THEN
IF Len(TRIM(Request.Form("flag"))) = 0 THEN
SQLstmt = "SELECT * FROM database WHERE dataID=" &
Request.QueryString("Recid")

Set rs = conn.Execute(SQLstmt)
IF NOT RS.EOF THEN
%>

<table>
<FORM METHOD="post" ACTION="dataupdate.asp?Actionvar=update">
<INPUT TYPE="text" size="78" NAME="dataMessage"
VALUE="<%=rs("Message")%>">

<INPUT TYPE="hidden" NAME="flag" VALUE="2">
<INPUT TYPE="hidden" NAME="Recordid" VALUE="<%=rs("dataID")%>">
<INPUT TYPE="submit" VALUE="Update">
</form>
</table>

<%
rs.MoveNext
rs.Close
END IF
ELSEIF Request.Form("flag")="2" THEN
comnt = request.form("dataMessage")
kament = Replace(comnt, "'", "''")

SQLstmt = "UPDATE database SET "
SQLstmt = SQLstmt & "Message='" & kament & "' "

any help please???

i believe the problem is in how i am displaying data in this part of
the code:
<INPUT TYPE="hidden" NAME="Recordid" VALUE="<%=rs("dataID")%>">
 
S

Steven Burn

You'll need to replace the quotes before they reach the database, using
something along the lines of;

Saving data;

yourdata = Request.Form("datamessage")
'// Replace quotes with: --
strData = Replace(yourdata, chr(34), "--")

Getting data;
'// replace -- with quotes
strData = Replace(yourdata, "--", chr(34))

--
Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

Disclaimer:
I know I'm probably wrong, I just like taking part ;o)
 
B

Bob Barrows

cooldv wrote:
<INPUT TYPE="hidden" NAME="Recordid" VALUE="<%=rs("dataID")%>">
Click to expand...

should be either this:

<INPUT TYPE="hidden" NAME="Recordid" VALUE='<%=rs("dataID")%>'>

or this:

<INPUT TYPE="hidden" NAME="Recordid" VALUE=
"<%=HTMLEncode(rs("dataID"))%>">

Check out this short example to see the difference:

<%
sText="text containing "" character"
Response.Write stext & "<BR>"
%>
<HTML>
<BODY>
<INPUT VALUE=" <%=server.HTMLEncode(sText)%>" style="WIDTH:345px">
</BODY>
</HTML>

HTH,
Bob Barrows
 
A

Aaron Bertrand [MVP]

You'll need to replace the quotes before they reach the database, using
something along the lines of;

Saving data;

yourdata = Request.Form("datamessage")
Click to expand...

Too late at that point. The problem isn't putting the data into the
database, it's that the data is truncated (by having value="foo"bar") before
it even gets to the ASP form handler.
Getting data;
'// replace -- with quotes
strData = Replace(yourdata, "--", chr(34))
Click to expand...

Plus, I disagree with this method altogether. Why would you replace quotes
with dashes? You're completely changing the meaning of the existing data,
plus you'll turn *ALL* dashes into double quotes when retrieving.
 
S

Steven Burn

Aaron Bertrand said:
Too late at that point. The problem isn't putting the data into the
database, it's that the data is truncated (by having value="foo"bar") before
it even gets to the ASP form handler.
Click to expand...
</snip>

In that case, couldn't you use some javascript code or something?

Plus, I disagree with this method altogether. Why would you replace quotes
with dashes? You're completely changing the meaning of the existing data,
plus you'll turn *ALL* dashes into double quotes when retrieving.
Click to expand...
</snip>

I just figured you could replace the quotes with something thats not likely
to be in there (doesn't have to be dashes obviously), so if you don't want
to use dashes, you could replace it with &quote or something?

--
Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

Disclaimer:
I know I'm probably wrong, I just like taking part ;o)
 
A

Aaron Bertrand [MVP]

I just figured you could replace the quotes with something thats not
likely
to be in there (doesn't have to be dashes obviously), so if you don't want
to use dashes, you could replace it with &quote or something?
Click to expand...

Again, the problem isn't in STORING the data. So a solution that involves
"encoding" the character to store in the database not only "vandalizes" the
data (someone running a SELECT column FROM table might not be aware of this
replace, and wonder why there's a dash or a tilde or some other character
when there should be a quote), it doesn't solve the issue anyway.
 
C

Chris Hohmann

Bob Barrows said:
cooldv wrote:


should be either this:

<INPUT TYPE="hidden" NAME="Recordid" VALUE='<%=rs("dataID")%>'>

or this:

<INPUT TYPE="hidden" NAME="Recordid" VALUE=
"<%=HTMLEncode(rs("dataID"))%>">

Check out this short example to see the difference:

<%
sText="text containing "" character"
Response.Write stext & "<BR>"
%>
<HTML>
<BODY>
<INPUT VALUE=" <%=server.HTMLEncode(sText)%>" style="WIDTH:345px">
</BODY>
</HTML>
Click to expand...

I'd like to vote for option 2, since it is immune to both apostrophes
( ' ) and quotes ( " ), as well any other entity references that may
exist in the data (less-than, greater-than, ampersand, etc...)
 
C

cooldv

Bob Barrows said:
cooldv wrote:


should be either this:

<INPUT TYPE="hidden" NAME="Recordid" VALUE='<%=rs("dataID")%>'>
Click to expand...


-------- No!!!! with this change, any text beyond an apostrophe '
sign in the data disappears

or this:

<INPUT TYPE="hidden" NAME="Recordid" VALUE=
"<%=HTMLEncode(rs("dataID"))%>">

Check out this short example to see the difference:

<%
sText="text containing "" character"
Response.Write stext & "<BR>"
%>
<HTML>
<BODY>
<INPUT VALUE=" <%=server.HTMLEncode(sText)%>" style="WIDTH:345px">
</BODY>
</HTML>

HTH,
Bob Barrows
Click to expand...

i could not understand what you meant by this. could you please be
more specific, how do i do that?
dataID or RecID is a numeric value and i have no trouble with the ID.
It is the TEXT with a double quote that is giving me hard time.

i put a demo of the problem here:
http://www.dv.pgims.org/datadisplay.asp

here is my code again:

<%
Actionvar=Request.QueryString("actionvar")

Set conn = server.createobject("adodb.connection")
DSNtemp="DRIVER={Microsoft Access Driver (*.mdb)}; "
DSNtemp=dsntemp & "DBQ=" & server.mappath("database.mdb")
conn.Open DSNtemp

IF Actionvar="update" THEN
IF Len(TRIM(Request.Form("flag"))) = 0 THEN
SQLstmt = "SELECT * FROM database WHERE dataID=" &
Request.QueryString("Recid")

Set rs = conn.Execute(SQLstmt)
IF NOT RS.EOF THEN
%>

<table>
<FORM METHOD="post" ACTION="dataupdate.asp?Actionvar=update">
<INPUT TYPE="text" size="78" NAME="dataMessage"
VALUE="<%=rs("Message")%>">

<INPUT TYPE="hidden" NAME="flag" VALUE="2">
<INPUT TYPE="hidden" NAME="Recordid" VALUE="<%=rs("dataID")%>">
<INPUT TYPE="submit" VALUE="Update">
</form>
</table>

<%
rs.MoveNext
rs.Close
END IF
ELSEIF Request.Form("flag")="2" THEN
comnt = request.form("dataMessage")
kament = Replace(comnt, "'", "''")

SQLstmt = "UPDATE database SET "
SQLstmt = SQLstmt & "Message='" & kament & "' "
 
A

Aaron Bertrand [MVP]

What he's suggesting is pretty simple. Change this:

<INPUT TYPE="text" size="78" NAME="dataMessage" VALUE="<%=rs("Message")%>">

To this:

<INPUT TYPE="text" size="78" NAME="dataMessage"
VALUE="<%=Server.HTMLEncode(rs("Message"))%>">
 
C

cooldv

Aaron Bertrand said:
What he's suggesting is pretty simple. Change this:

<INPUT TYPE="text" size="78" NAME="dataMessage" VALUE="<%=rs("Message")%>">

To this:

<INPUT TYPE="text" size="78" NAME="dataMessage"
VALUE="<%=Server.HTMLEncode(rs("Message"))%>">
Click to expand...


Thank you, Bob Barrows for your solution and Aaron Bertrand for your clarification.

The above solution is working like a charm. Thanks again.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

How to store data from a sign up form on a website into an sql databse 1
Help with popup display 1
Registration Form 7
I dont get this. Please help me!! 2
I want to Display Excel As HTML In js 2
Issue with passing fetched data to POST form. How can I? 0
Please, help me. 1
Registration form 13

Members online

Total: 37 (members: 2, guests: 35)
Robots: 184

Forum statistics

Threads
473,764
Messages
2,569,564
Members
45,040
Latest member
papereejit

Latest Threads

Top