View Single Post
  #9 (permalink)  
Old November 14th, 2008, 09:13 PM
Old Pedant Old Pedant is offline
Friend of Wrox
Points: 4,805, Level: 29
Points: 4,805, Level: 29 Points: 4,805, Level: 29 Points: 4,805, Level: 29
Activity: 38%
Activity: 38% Activity: 38% Activity: 38%
 
Join Date: Jun 2008
Location: Snohomish, WA, USA
Posts: 1,323
Thanks: 3
Thanked 70 Times in 69 Posts
Default

Okay, so now I *will* say that I think there is still a mistake in this code:
Code:
sSQL = "INSERT INTO tbl-RmaNumberLog([ExpeditedOrder], [RmaCompanyName], [RmaStreetAdd1]," & _
"[RmaStreetAdd2], [RmaCity], [RmaState], [RmaZipCode], [RmaCountry]," & _
"[RmaTelephone], [RmaExt], [RmaFax], [RmaE-mail ], [RmaPONumber],[RecordCreator], [RmaNumber]" & _
"[RmaCarrierAcc], [NistCertification], [RmaNotes])" & _
" VALUES('" & Me.CheckExpeditedOrder & "', '" & Me.TextRmaCompanyName & "', '" & Me.TextRmaStreetAdd1 & "'," etc.
Now that looks exactly like how you'd do it in ASP/ADO/VBScript. And now it looks to me like you have forgotten to account for the possibility of an apostrophe within some data (some form field).

I think that you probably need to do
Code:
...
    " VALUES('" & Replace(Me.CheckExpeditedOrder,"'","''") & "', " _
    &       "'" & Replace(Me.TextRmaCompanyName,"'","''") & "', " _
    ... etc. ...
No?

MMcDonal says he does the validation before building the query, so likely he takes care of the apostrophe problem as part of validation. That's what I do with ASP/ADO/VBScript.
Reply With Quote