inserting apostrophes into DB?

[Lord Merlin]

When I insert info into a DB from a form, it cuts the string off at the
first apostrophe (").

How would I make it insert the data as-is, with the apostrophes?
Here is the code used to insert the Data:

strsubject = " " & GetFormData("strsubject") & " "
incident = " " & GetFormData("incident") & " "
solution = " " & GetFormData("solution") & " "
InsertQuery="INSERT INTO comments " &_
"(NUserID,thedate, currentdate, commenttype, userid, username,
supplier, person, subject, description, solution, industry, country,
province, city, area, emailsent, clientresponse, compliment,
complaint,telno,subscriber)" &_
" VALUES (" & Session("NUserID") & ", '" &_
thedate & "','" &_
currentdate & "','" &_
strcomment & "'," &_
Session("NUserID") & ",'" &_
alias & "','" &_
Replace(companyname,"'","''") & "','" &_
person & "','" &_
Replace(strsubject, "'", chr(39) & chr(39)) & "','" &_
Replace(incident, "'", chr(39) & chr(39)) & "','" &_
Replace(solution, "'", chr(39) & chr(39)) & "','" &_
industry & "','" &_
country & "','" &_
province & "','" &_
city & "','" &_
area & "','" &_
"no" & "','" &_
"" & "'," &_
compliment & "," &_
complaint & ",'" &_
telno & "','" & ticksubscriber & "');Select @@IDENTITY as id;"

The problem lies with these three:
strsubject, incident, solution

What can I do?

--
Kind Regards
Rudi Ahlers
[phone]

Greater love has no one than this, that he lay down his life for his friends
(John 15:13).

[Steven Burn]

Server.HTMLEncode() ?

--

Regards

Steven Burn
Ur I.T. Mate Group
www.it-mate.co.uk

Keeping it FREE!
"Lord Merlin" <SP*************@bonzai.org.za_SPAM> wrote in message
news:cc**********@ctb-nnrp2.saix.net...

When I insert info into a DB from a form, it cuts the string off at the
first apostrophe (").

How would I make it insert the data as-is, with the apostrophes?
Here is the code used to insert the Data:

strsubject = " " & GetFormData("strsubject") & " "
incident = " " & GetFormData("incident") & " "
solution = " " & GetFormData("solution") & " "
InsertQuery="INSERT INTO comments " &_
"(NUserID,thedate, currentdate, commenttype, userid, username,
supplier, person, subject, description, solution, industry, country,
province, city, area, emailsent, clientresponse, compliment,
complaint,telno,subscriber)" &_
" VALUES (" & Session("NUserID") & ", '" &_
thedate & "','" &_
currentdate & "','" &_
strcomment & "'," &_
Session("NUserID") & ",'" &_
alias & "','" &_
Replace(companyname,"'","''") & "','" &_
person & "','" &_
Replace(strsubject, "'", chr(39) & chr(39)) & "','" &_
Replace(incident, "'", chr(39) & chr(39)) & "','" &_
Replace(solution, "'", chr(39) & chr(39)) & "','" &_
industry & "','" &_
country & "','" &_
province & "','" &_
city & "','" &_
area & "','" &_
"no" & "','" &_
"" & "'," &_
compliment & "," &_
complaint & ",'" &_
telno & "','" & ticksubscriber & "');Select @@IDENTITY as id;"

The problem lies with these three:
strsubject, incident, solution

What can I do?

--
Kind Regards
Rudi Ahlers
[phone]

Greater love has no one than this, that he lay down his life for his friends (John 15:13).

[Mark Schupp]

Are you sure it is truncating in the database (not on a form after it is
extracted from the database)?

The Replace statements in your code should take care of the apostrophes in
the insert statement.

--
Mark Schupp
Head of Development
Integrity eLearning
www.ielearning.com
"Lord Merlin" <SP*************@bonzai.org.za_SPAM> wrote in message
news:cc**********@ctb-nnrp2.saix.net...

When I insert info into a DB from a form, it cuts the string off at the
first apostrophe (").

How would I make it insert the data as-is, with the apostrophes?
Here is the code used to insert the Data:

strsubject = " " & GetFormData("strsubject") & " "
incident = " " & GetFormData("incident") & " "
solution = " " & GetFormData("solution") & " "
InsertQuery="INSERT INTO comments " &_
"(NUserID,thedate, currentdate, commenttype, userid, username,
supplier, person, subject, description, solution, industry, country,
province, city, area, emailsent, clientresponse, compliment,
complaint,telno,subscriber)" &_
" VALUES (" & Session("NUserID") & ", '" &_
thedate & "','" &_
currentdate & "','" &_
strcomment & "'," &_
Session("NUserID") & ",'" &_
alias & "','" &_
Replace(companyname,"'","''") & "','" &_
person & "','" &_
Replace(strsubject, "'", chr(39) & chr(39)) & "','" &_
Replace(incident, "'", chr(39) & chr(39)) & "','" &_
Replace(solution, "'", chr(39) & chr(39)) & "','" &_
industry & "','" &_
country & "','" &_
province & "','" &_
city & "','" &_
area & "','" &_
"no" & "','" &_
"" & "'," &_
compliment & "," &_
complaint & ",'" &_
telno & "','" & ticksubscriber & "');Select @@IDENTITY as id;"

The problem lies with these three:
strsubject, incident, solution

What can I do?

--
Kind Regards
Rudi Ahlers
[phone]

Greater love has no one than this, that he lay down his life for his friends (John 15:13).

[Jeff Cochran]

On Thu, 1 Jul 2004 22:24:18 +0200, "Lord Merlin"
<SP*************@bonzai.org.za_SPAM> wrote:

When I insert info into a DB from a form, it cuts the string off at the
first apostrophe (").

How would I make it insert the data as-is, with the apostrophes?
See this:

Crossposting vs. Multiposting:
http://www.blakjak.demon.co.uk/mul_crss.htm

Then check the respone I posted in another group you posted in.

Jeff

strsubject = " " & GetFormData("strsubject") & " "
incident = " " & GetFormData("incident") & " "
solution = " " & GetFormData("solution") & " "
InsertQuery="INSERT INTO comments " &_
"(NUserID,thedate, currentdate, commenttype, userid, username,
supplier, person, subject, description, solution, industry, country,
province, city, area, emailsent, clientresponse, compliment,
complaint,telno,subscriber)" &_
" VALUES (" & Session("NUserID") & ", '" &_
thedate & "','" &_
currentdate & "','" &_
strcomment & "'," &_
Session("NUserID") & ",'" &_
alias & "','" &_
Replace(companyname,"'","''") & "','" &_
person & "','" &_
Replace(strsubject, "'", chr(39) & chr(39)) & "','" &_
Replace(incident, "'", chr(39) & chr(39)) & "','" &_
Replace(solution, "'", chr(39) & chr(39)) & "','" &_
industry & "','" &_
country & "','" &_
province & "','" &_
city & "','" &_
area & "','" &_
"no" & "','" &_
"" & "'," &_
compliment & "," &_
complaint & ",'" &_
telno & "','" & ticksubscriber & "');Select @@IDENTITY as id;"

The problem lies with these three:
strsubject, incident, solution

What can I do?

[Aaron [SQL Server MVP]]

Replace ' with '' not two chr(39)s.

Here is how I do it:

Function doubleApost(str)
doubleApost = Replace(str, "'", "''")
End Function
sql = "INSERT tbl(col) VALUES('" & doubleApost(Request.Form("foo")) & "')"

If you are using SQL Server 2000, use SCOPE_IDENTITY, not @@IDENTITY. And
consider using a stored procedure. Your string building will be much
easier, especially if you use a parameters collection. And your chances for
SQL injection attacks will go to nearly nil.

--
http://www.aspfaq.com/
(Reverse address to reply.)


"Lord Merlin" <SP*************@bonzai.org.za_SPAM> wrote in message
news:cc**********@ctb-nnrp2.saix.net...

When I insert info into a DB from a form, it cuts the string off at the
first apostrophe (").

How would I make it insert the data as-is, with the apostrophes?
Here is the code used to insert the Data:

strsubject = " " & GetFormData("strsubject") & " "
incident = " " & GetFormData("incident") & " "
solution = " " & GetFormData("solution") & " "
InsertQuery="INSERT INTO comments " &_
"(NUserID,thedate, currentdate, commenttype, userid, username,
supplier, person, subject, description, solution, industry, country,
province, city, area, emailsent, clientresponse, compliment,
complaint,telno,subscriber)" &_
" VALUES (" & Session("NUserID") & ", '" &_
thedate & "','" &_
currentdate & "','" &_
strcomment & "'," &_
Session("NUserID") & ",'" &_
alias & "','" &_
Replace(companyname,"'","''") & "','" &_
person & "','" &_
Replace(strsubject, "'", chr(39) & chr(39)) & "','" &_
Replace(incident, "'", chr(39) & chr(39)) & "','" &_
Replace(solution, "'", chr(39) & chr(39)) & "','" &_
industry & "','" &_
country & "','" &_
province & "','" &_
city & "','" &_
area & "','" &_
"no" & "','" &_
"" & "'," &_
compliment & "," &_
complaint & ",'" &_
telno & "','" & ticksubscriber & "');Select @@IDENTITY as id;"

The problem lies with these three:
strsubject, incident, solution

What can I do?

--
Kind Regards
Rudi Ahlers
[phone]

Greater love has no one than this, that he lay down his life for his friends (John 15:13).