inserting apostrophes into DB?

[Lord Merlin]

When I insert info into a DB from a form, it cuts the string off at the
first apostrophe (").

How would I make it insert the data as-is, with the apostrophes?
Here is the code used to insert the Data:



strsubject = " " & GetFormData("strsubject") & " "
incident = " " & GetFormData("incident") & " "
solution = " " & GetFormData("solution") & " "


InsertQuery="INSERT INTO comments " &_
"(NUserID,thedate, currentdate, commenttype, userid, username,
supplier, person, subject, description, solution, industry, country,
province, city, area, emailsent, clientresponse, compliment,
complaint,telno,subscriber)" &_
" VALUES (" & Session("NUserID") & ", '" &_
thedate & "','" &_
currentdate & "','" &_
strcomment & "'," &_
Session("NUserID") & ",'" &_
alias & "','" &_
Replace(companyname,"'","''") & "','" &_
person & "','" &_
Replace(strsubject, "'", chr(39) & chr(39)) & "','" &_
Replace(incident, "'", chr(39) & chr(39)) & "','" &_
Replace(solution, "'", chr(39) & chr(39)) & "','" &_
industry & "','" &_
country & "','" &_
province & "','" &_
city & "','" &_
area & "','" &_
"no" & "','" &_
"" & "'," &_
compliment & "," &_
complaint & ",'" &_
telno & "','" & ticksubscriber & "');Select @@IDENTITY as id;"

The problem lies with these three:
strsubject, incident, solution

What can I do?

--


Kind Regards
Rudi Ahlers
+27 (82) 926 1689

Greater love has no one than this, that he lay down his life for his friends
(John 15:13).

 

[Steven Burn]

Server.HTMLEncode() ?

--

Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!

 

[Mark Schupp]

Are you sure it is truncating in the database (not on a form after it is
extracted from the database)?

The Replace statements in your code should take care of the apostrophes in
the insert statement.

 

[Jeff Cochran]

When I insert info into a DB from a form, it cuts the string off at the
first apostrophe (").

How would I make it insert the data as-is, with the apostrophes?

See this:

Crossposting vs. Multiposting:
http://www.blakjak.demon.co.uk/mul_crss.htm

Then check the respone I posted in another group you posted in.

Jeff

 

[Aaron [SQL Server MVP]]

Replace ' with '' not two chr(39)s.

Here is how I do it:

Function doubleApost(str)
doubleApost = Replace(str, "'", "''")
End Function
sql = "INSERT tbl(col) VALUES('" & doubleApost(Request.Form("foo")) & "')"

If you are using SQL Server 2000, use SCOPE_IDENTITY, not @@IDENTITY. And
consider using a stored procedure. Your string building will be much
easier, especially if you use a parameters collection. And your chances for
SQL injection attacks will go to nearly nil.