Sep 30, 2004 #1 adonet MIS May 4, 2004 312 US In SQL statement, if write "where last_name = 'O'connor'" will cause an error. How to handle it?
Sep 30, 2004 #2 influent1 Programmer Sep 20, 2004 10 US Depends. Do you want to handle it in the VB code or the SQL code? If VB, then: Replace(<name as string>, "'", "''") Upvote 0 Downvote
Depends. Do you want to handle it in the VB code or the SQL code? If VB, then: Replace(<name as string>, "'", "''")
Sep 30, 2004 #3 influent1 Programmer Sep 20, 2004 10 US In case that's hard to read, you're replacing the single quote with two single quotes. Upvote 0 Downvote
Sep 30, 2004 #4 chrissie1 Programmer Aug 12, 2002 4,517 BE or use parameters as suggested before. Christiaan Baes Belgium If you want to get an answer read this FAQ faq796-2540 There's no such thing as a winnable war - Sting Upvote 0 Downvote
or use parameters as suggested before. Christiaan Baes Belgium If you want to get an answer read this FAQ faq796-2540 There's no such thing as a winnable war - Sting
Oct 1, 2004 #5 chiph Programmer Jun 9, 1999 9,878 US I strongly suggest using ADO parameters. Do a Google search for "SQL Injection". Chip H. ____________________________________________________________________ If you want to get the best response to a question, please read FAQ222-2244 first Upvote 0 Downvote
I strongly suggest using ADO parameters. Do a Google search for "SQL Injection". Chip H. ____________________________________________________________________ If you want to get the best response to a question, please read FAQ222-2244 first