Apostrohy's in an email address

[oldwen]

Hello all,

I have a webform that when submitted updates an Access database. I had a customer today that has and apostrophy in their email address (ie strong'man@yahoo.com). I was recieving a syntax error because of this. My code works like this. Submit form, assign a request.form value to a variable, place variable in SQL string, update DB. How can I use a similar technique and keep the apostrophy?

Acutal Code:

Dim first, last, Title, Cname, Address, City, State, Zip, Phone, fax, Email
Dim orig, quality, reo, q1, q2, q3, loc

first = Request.Form("first&quot
last = Request.Form("last&quot
title = Request.Form("Title&quot
cname = Request.Form("cname&quot
Address = Request.Form("Address&quot
City = Request.Form("City&quot
State = Request.Form("State&quot
Zip = Request.Form("Zip&quot
Phone = Request.Form("Phone&quot
fax = Request.Form("fax&quot
Email = Request.Form("Email&quot
orig = Request.Form("c1&quot
quality = Request.Form("c2&quot
reo = Request.Form("c3&quot
q1 = Request.Form("q1&quot
q2 = Request.Form("q2&quot
q3 = Request.Form("q3&quot

INSERT INTO Orlando (Fname, Lname, Title, Company, Address, City, State, Zip, Phone, Fax, Email, Origination, Quality, REO, q1, q2, q3) VALUES ('"&first&"', '"&Last&"', '"&Title&"', '"&cname&"', '"&Address&"', '"&City&"', '"&State&"', '"&Zip&"', '"&Phone&"', '"&Fax&"', '"&Email&"', '"&Orig&"', '"&Quality&"', '"&REO&"', '"&q1&"', '"&q2&"', '"&q3&"')"

Any help would be great.

Oldwen

 

[onpnt]

try doing a search in google.com on SQL Injection. you're eyes will be wide open at what you'll find.

also there are many, many threads on this topic here and many, many replies that answer it with examples.

hope that helps

___________________________________________________________________

http://www.onpnt.com

The answer to your ??'s may be closer then you think.
Check out Tek-Tips knowledge bank by clicking the FAQ link at the top of the page

 

[SQL2KDBA69]

use replace() to replace the apostrophy

eg:

Email=Replace(Request.Form("Email&quot,"'","''&quot

this will stop the error and keep your email address with the apostrophy.

 

[mwolf00]

If you don't follow onpnt's suggestion and read up on sql injection, at least make sure to NEVER ALLOW A USER TO SUBMIT A SINGLE QUOTE TO YOUR DATABASE!!!!

Programming today is a race between software engineers striving to build better and bigger idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. - Rick Cook (No, I'm not Rick)