Sep 30, 2004 #1 adonet MIS Joined May 4, 2004 Messages 312 Location US In SQL statement, if write "where last_name = 'O'connor'" will cause an error. How to handle it?
Sep 30, 2004 #2 influent1 Programmer Joined Sep 20, 2004 Messages 10 Location US Depends. Do you want to handle it in the VB code or the SQL code? If VB, then: Replace(<name as string>, "'", "''") Upvote 0 Downvote
Depends. Do you want to handle it in the VB code or the SQL code? If VB, then: Replace(<name as string>, "'", "''")
Sep 30, 2004 #3 influent1 Programmer Joined Sep 20, 2004 Messages 10 Location US In case that's hard to read, you're replacing the single quote with two single quotes. Upvote 0 Downvote
Sep 30, 2004 #4 chrissie1 Programmer Joined Aug 12, 2002 Messages 4,517 Location BE or use parameters as suggested before. Christiaan Baes Belgium If you want to get an answer read this FAQ faq796-2540 There's no such thing as a winnable war - Sting Upvote 0 Downvote
or use parameters as suggested before. Christiaan Baes Belgium If you want to get an answer read this FAQ faq796-2540 There's no such thing as a winnable war - Sting
Oct 1, 2004 #5 chiph Programmer Joined Jun 9, 1999 Messages 9,878 Location US I strongly suggest using ADO parameters. Do a Google search for "SQL Injection". Chip H. ____________________________________________________________________ If you want to get the best response to a question, please read FAQ222-2244 first Upvote 0 Downvote
I strongly suggest using ADO parameters. Do a Google search for "SQL Injection". Chip H. ____________________________________________________________________ If you want to get the best response to a question, please read FAQ222-2244 first