Error when user submits form with ; in value

[tdmailbox]

I have a function that hashs the value that a user entered in a text
box and stored that hash value as a password. All is well unless a
user enters a password that when hased has a ; in it.

If a user entered 33333333 as the password my hash function returns a
value that includes a ; and then the DoCmd.RunSQl fails.

Is there a good way of fixing this? Since it is a hash of the password
I was thinking of maybe just running a function that replaces the ;
with another character before saving the value into the database.

my question is what would be the best way to do this? Also are there
any characters that I need to worry about?

txtUSERPWD_NEW_HASH = HashString(txtUSERPWD_NEW)

DoCmd.SetWarnings False

DoCmd.RunSQL "UPDATE T_USER SET T_USER.USERPWD='" & txtUSERPWD_NEW_HASH
& "' WHERE T_USER.USERID='" & txtUSERID & "' ;"
DoCmd.SetWarnings True

[MGFoster]

td*******@yahoo.com wrote:

I have a function that hashs the value that a user entered in a text
box and stored that hash value as a password. All is well unless a
user enters a password that when hased has a ; in it.

If a user entered 33333333 as the password my hash function returns a
value that includes a ; and then the DoCmd.RunSQl fails.

Is there a good way of fixing this? Since it is a hash of the password
I was thinking of maybe just running a function that replaces the ;
with another character before saving the value into the database.

my question is what would be the best way to do this? Also are there
any characters that I need to worry about?

txtUSERPWD_NEW_HASH = HashString(txtUSERPWD_NEW)

DoCmd.SetWarnings False

DoCmd.RunSQL "UPDATE T_USER SET T_USER.USERPWD='" & txtUSERPWD_NEW_HASH
& "' WHERE T_USER.USERID='" & txtUSERID & "' ;"
DoCmd.SetWarnings True

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Using Access 2002 (ANSI-92 SQL) I couldn't replicate the error. Here's
what I did:

strPWD = HashString(Me!txtUSERPWD_NEW)

strSQL = "UPDATE T_USER SET USERPWD='" & strPWD & "'" & _
"WHERE USERID='" & Me!txtUSERID & "'"

CurrentDb.Execute strSQL, dbFailOnError

--
MGFoster:::mgf00 <at> earthlink <decimal-point> net
Oakland, CA (USA)

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBQhk/Q4echKqOuFEgEQIBiACeOXO+9r3T0G4qPejpJ0FSamp3X0wAmw XV
Hfzj4h5JniT5yowQNujo1MHS
=qaLx
-----END PGP SIGNATURE-----

[tdmailbox]

I tried modifying the code so that the ' was moved out inside a
seperate set of " "

However, I still run into the same issue where when
txtUSERPWD_NEW_HASH contains a ;

This makes sense as a ; ends a line of SQL code.
T_USER.USERPWD='" & txtUSERPWD_NEW_HASH & "'" & "WHERE T_USER.USERID='"
& txtUSERID & "' ;"

[pietlinden]

then you could, I suppose, open an updatable recordset with just one
record in it and do this...

rs.Open "..."
rs.Edit
rs.Fields("Password")=HashString(Me!txtUSERPWD_NEW )
rs.Update