apostrophes and double quotes

[kjoost001]

does anyone know how to eliminate the problem of double quotes and apostrophes.
if there is an apostrophe in my sql statement, it causes a break in the string. thus, when I try to do an insert from my .asp page, it fails. It is really annoying and I was wondering if someone could help me. Is there a way to parse the string and if an apostrophe or double quote appears replace it with "'"?? I dont know.

Thanks,
Ken

 

[JuanitaC]

Just use

Replace(string, "'", "''&quot

The easiest way to do this is to change the value that you are putting into your SQL string. Something like this:

sql = sql & "column = '" & Replace(value, "'", "''&quot & "'"

 

[smh1]

You could use Replace to replace any single apostrophe with a string of 2 singles, e.g. MyField = Replace(MyField,"'","''&quot.

Steve

 

[Ayac]

SQL uses '' as one ', so it works fine if you replace those with two single quots before you write it back to the database as others told you before me.

In addition be careful when you display it on screen or sending it out as a variable value too when reading it out from your database.
Use the Server.HTMLEncode(ObjectName("VariableName&quot) method to display the content from a recordset, and always put your content between " double quots (using the ascii code), instead of ' single quots:

Like writing out an alt tag like that:

Response.Write &quot;<img src='image.jpg' alt=&quot; & chr(34) & Server.HTMLEncode(ObjectName(&quot;VariableName&quot) & chr(34) & &quot;>&quot;

because if the single quots are not in pair that can make your HTML look ungly too.