Hi,
   If I write a SQL Statement in ASP like
"SELECT * FROM tblMember WHERE strFirstName = '" & request.form("txtFirstName") & "';"

If the txtFirstName doesn't have ' in the string, then there will have no problem.
But if the string has ' , how could I deal with this?
Please Help. Thank you.

Hi there,

You'll need to "escape" the ' with another ', like this:

INSERT INTO Users (UserName) VALUES ('O''Brien')

This will eventually insert O'Brien in the database.

In ASP, you can use the Replace method to accomplish this:

strFirstName = Request.Form("txtFirstName :)
strFirstName = Replace(strFirstName, "'", "''")

Now strFirstName is "SQL safe" because the single apostrophes have been escaped......


HtH,

Imar


---------------------------------------
Imar Spaanjaars
Everyone is unique, except for me.