Building SQL Statements
Written by Eric Smith, Northstar Computer Systems LLC
If you are building SQL statements within your ASP code that have data that might have single quote characters in it, be sure to replace every single quote with two single quotes. This is really easy to do with the new Replace function. Simply run the Replace function on each data value you're appending to your SQL query, as shown in this example:
strName = "Mrs. O'Leary"
strSQL = "SELECT * FROM Emp WHERE Name = " & Replace(strName, "'", "''")
This replaces each single quote in strName with two single quotes. Both Access and SQL Server will properly handle the single quote as long as it is marked in this manner.
Keywords: [
SQL
]
Publication Date: 9/1/1999, Last Update: 2/25/2010
|