Keeping a DB clean

[Ragol1]

I wonder if someone could show me how to keep a DB clean when I pass data from a form to an ASP page then the DB,
I Think there are certain things a DB doesnt like or Even ASP doesnt like to be in a form, and i just want to know how to strip those things before they go to the database.


Am I making sense?????

Nick

 

[harmmeijer]

You can submit anything from an html form into a database.
Here are some rules:

If you have a form where the user can fill in text:
Make sure to set the maxlength property of an input text
box so the user cannot exeed the length of characters of
the db field.
In your update statement replace all ' characters with ''
like so:
replace(request("formfield&quot,"'","''",1,1,1)

If you have to insert a date see this url:

http://www.geocities.com/harm_meijer/opencal.htm

If you have to insert numbers:
I suggest a good client script (code is not availeble on
my site yet) to check if the data filled in is a number,
has not to many decimal places, is not too small/big
etc..