INSERT INTO problem

[SU_Oran]

This is on my HTML page

<td align=center>
<textarea cols="85" rows="7" name="Problem"></textarea>
</td>

User enters information into this box.

If they use either a quote or double quote, but SQL statement bombs. Is
there a way quick way to fix this beforehand?
Conn.execute ("INSERT INTO PROBLEMS (Problem) VALUES ('" & Problem & "')")

Thanks in advance

 

[Bob Barrows [MVP]]

This is on my HTML page

<td align=center>
<textarea cols="85" rows="7" name="Problem"></textarea>
</td>

User enters information into this box.

If they use either a quote or double quote, but SQL statement bombs.
Is there a way quick way to fix this beforehand?
Conn.execute ("INSERT INTO PROBLEMS (Problem) VALUES ('" & Problem &
"')")

This is easily fixed by not using dynamic sql:


dim cmd, sSQL
sSQL = "INSERT INTO PROBLEMS (Problem) VALUES (?)"
set cmd=createobject("adodb.command")
cmd.commandtext=sSQL
set cmd.activeconnection=conn
cmd.Execute ,array(Problem),129

Bob Barrows

 

[Gérard Leclercq]

The best way is to use a stored procedure. Then you don't have to worry
about any kind of quotes.
More basic is
Conn.execute ("INSERT INTO PROBLEMS (Problem) VALUES (" & Chr(34) &
Replace("'","another value") & Chr(34))