In order to protect from SQL injection we need to replace ' with ", so I 
used replace function but it doesn't work.

username=replace(username,"'",""")

the above statement is what I do at both client side and server side.
Can anyone help me on this?

You need FOUR double quotes:
	username=replace(username,"'","""")

Larry Woods

> -----Original Message-----
> From: ysiline@r... [mailto:ysiline@r...]
> Sent: Tuesday, December 10, 2002 11:54 AM
> To: Access ASP
> Subject: [access_asp] replace function not work
>
>
> In order to protect from SQL injection we need to
> replace ' with ", so I
> used replace function but it doesn't work.
>
> username=replace(username,"'",""")
>
> the above statement is what I do at both client side
> and server side.
> Can anyone help me on this?
>