Using paramters does not work with single quotes

[BadRabbit]

I'm trying to update a field from a form using parameters but it will not accept single quotes. It just cuts off the text, so "Bill's Record" would just be updated as "Bill".

The solution on all the web pages I've seen, i.e. replacing the single quotes with two single quotes doesn't work. It does exactly the same thing. This is part of the code...

cmd.Parameters.Add("@id", SqlDbType.Int).Value = parID
parName=replace(parName,"'","''&quot
cmd.Parameters.Add("@name", SqlDbType.VarChar, 255).Value = parName

I can't change any database fields nor can I remove the quotes, so I need to get this working. Does anyone have any ideas. parName is being assigned correctly (e.g. "Bill''s Record&quot but SQL Server thinks two quotes is the same as one.

 

[BadRabbit]

It's doing the same when it retrieves data, just displaying the stuff before the single quote. The code is very simple, below, so maybe it's a SQL Server problem not an ASP.NET one. Yes, I should have stayed with Access and ASP - much more productive.

dim dr as SqlDataReader
sc = "select cat_name from categories where cat_id="+cstr(parID)
cmd = new SqlCommand(sc,cn)
cmd.CommandType = CommandType.Text
cn.Open()
dr = cmd.ExecuteReader()
dr.read()
parName=dr("cat_name&quot

... parName is always returned with the section after the quote chopped of.

 

[BadRabbit]

Problem solved. No idea how. I've had to make all my form fields into text areas. Baffling.