using single qoutes with sql

• • Reply

  12 years ago

  by depash

  Patric

  , France

  Joined 12 years ago
  Hi, I have a problem with my sql code in vb6. Am using an insert into() and select statement to work with an ms access database. the problem is that if somebody enters a name with a single quote, the the application causes an error and the program terminates. Have tried to use the vb6 replace function but seems not to work. my code is like: select * from master_tbl where ITEM_NAME='" & replace(txtItemName.text,"'","''") & "'. ANY HELP WILL BE HIGHLY APPRECIATED. Thanx in advance.
  Report abuse
• • Reply

  12 years ago

  by Slicksim

  Simon Cooper

  Lancaster, United Kingdom

  Joined 15 years ago
  Hi, The problem you are facing i think is due to using inline sql rather than a parameterised query. The method you have there opens you up to an SQL injection attack. Switch to a parameterised query, and the qoutes won't be a problem. Si
  Report abuse