quotation 1

[cjkenworthy]

I've done some inserts/updates inserting variables into SQL statements e.g:

"UPDATE table SET attribute = '" & variable & "'"

problem is, if the user puts in a value into variable e.g:

he'llo ... or ... chris's

Then the execution messes up, as SQL thinks that the apostrophes are part of the statement.

How can I get SQL to take any apostrophe's inside the two in the statement '" "' as just part of the value?

(would a good approach be - if a ' is detected double it?)

Chris.

 

[dilettante]

That's exactly what you want to do. The easiest way is to use the VBScript Replace() function, as in:

"UPDATE table SET attribute = '" & Replace(variable, "'", "''") & "'"