I have a form which lets the user search for things. Depending on a combo box, the parameter could be a text or number. The search function will generate the querie corresponding to the combo box/parameter.
I would like to know what is the conventional way of filtering a textbox before it gets appeneded onto an SQL string and executed. I.e if some user types in "[blahlhala]" or some characters like "]\}.?&$" etc I would like to filter them so that it will not mess up the query or validate it ebefore it gets executed. In general I would like to filter
1. a parameter that is all letters in range A-Z and a-z is valid
2. a parameter that is a number is valid
I would like to know how to check for things like this.
TIA.
I would like to know what is the conventional way of filtering a textbox before it gets appeneded onto an SQL string and executed. I.e if some user types in "[blahlhala]" or some characters like "]\}.?&$" etc I would like to filter them so that it will not mess up the query or validate it ebefore it gets executed. In general I would like to filter
1. a parameter that is all letters in range A-Z and a-z is valid
2. a parameter that is a number is valid
I would like to know how to check for things like this.
TIA.