Database won't accept Apostrophes ( ' )

[nhurst1369]

This works to update the database as long as there are no ' (Apostrophes) in the fields. Can anybody recomend a solution to this problem?

<%
Dim ID, status, results, tester, notes, timestamp, arr_ids
ID= Request.Form(&quot;ID&quot
Dim Conn, Rs, sql, sql_update
Set Conn = Server.CreateObject(&quot;ADODB.Connection&quot
Set Rs = Server.CreateObject(&quot;ADODB.Recordset&quot
Conn.Open &quot;DRIVER={Microsoft Access Driver (*.mdb)}; DBQ=&quot; & Server.MapPath(&quot;sr6.mdb&quot

sql= &quot;Update tbldts Set status='&quot;&Request.Form(&quot;status&quot&&quot;', results='&quot;&Request.Form(&quot;results&quot&&quot;', tester='&quot;&Request.Form(&quot;tester&quot&&quot;', notes='&quot;&Request.Form(&quot;notes&quot&&quot;' WHERE index=&quot;&ID

Rs.Open sql, Conn
Conn.Close
Set Rs=Nothing
Set Conn = Nothing
Response.Write &quot;Successfully Updated&quot;
%>

 

[mwolf00]

you need to double them up...

replace(request(&quot;fieldName&quot,&quot;'&quot;,&quot;''&quot

also read up on SQL Injection attacks....

Programming today is a race between software engineers striving to build better and bigger idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning. - Rick Cook (No, I'm not Rick)