ASP code with Quotes in text and sql field name

[Nicholls]

We are having trouble getting text into our SQL table for fields with quotes in the text. In the ASP example below, we have an array called names that has the field names in it. When the text from the web form contains quotes, the data that is written into the SQL field ends when the first quote is found. We have to be able to accept either single or double quotes in the text.

names = array("FirstName", "MI", "etc&quot

szName = names(0)
szValues = "'" + Request.Form(names(0)) + "'"


We are still learning ASP, but this is very frustrating!!!

Jeff and Linea

 

[jmcpher]

When using sql, you must replace all single quotes with two single quotes. So the string:
'John'
goes into the database like:
Update Names set FirstName = '''John'''... "Programming is like sex, one mistake and you have to support it forever."

John

johnmc@mvmills.com

 

[lobstah]

can you post your SQL statement also?

if you have a single quote in your text, (for example: O'Reilly) then what

szValues = "'" + Request.Form(names(0)) + "'"

will give is:

szValues = "'O'Reilly'"

So what happens is that it stops at the ' after the O.

If you replace ' with double 's, then you should be all set:

szValues = "'" + Replace(Request.Form(names(0)),"'", "''&quot + "'"

 

[Nicholls]

Thanks for your help! After some tweeking with your tips, we got it working!