I know this is a basic question - but I have a number of forms that the info is being sent to an access database - which is a better idea...to not allow any stray characters or single quotes (by use of a jscript validation function) or is it better (at least for single quotes) to before I enter the info into the database just run replase functin on all the fields and replace single quote with double single quote...

which is the better idea?

thanks for your help

Adina

IMO, the latter as it serves two purposes: first, the user's intent with the text is maintained (what happens if they want to type something like "the user's intent"??). Second, JavaScript can be disabled, bypassing your validation.

Only by fixing the data server side can you guarantee a safe and working solution.

Cheers,

Imar


---------------------------------------
Imar Spaanjaars
http://Imar.Spaanjaars.Com
Everyone is unique, except for me.
Author of ASP.NET 2.0 Instant Results and Beginning Dreamweaver MX / MX 2004

So would using the replace function on all fields be the best way of accomplishing that?

Also this might be a stupid question but should I be building my sights to not depend on JScript as of now.... I have a lot of rollover, and drop down menus that are jscript dependant ...what should I be doing....

Thank you,
Adina

Yes, you'd need to fix every field you're about to send to the database.

Regarding JavaScript: it depends. Some effects can be accomplished with CSS, other things cannot be reproduced with other technologies easily. However, it all depends on your site of course. I generally find that people have JavaScript turned on. YMMV of course so you need to look into to your client base and see if it's worth the trouble.

Cheers

Imar

---------------------------------------
Imar Spaanjaars
http://Imar.Spaanjaars.Com
Everyone is unique, except for me.
Author of ASP.NET 2.0 Instant Results and Beginning Dreamweaver MX / MX 2004