asp/access - Insert " into a database??

[meztec]

Here's my problem...
I built a quick cms with asp/access ..it works ..
I have an html form page that inputs records into the database...

However in my content field im getting this error
---
Error Type:
Microsoft JET Database Engine (0x80040E14)
Syntax error (missing operator) in query expression ''"blabab df": afdssdaasdf 'sadflds')'.
/press/admin/addRelease.asp, line 34
----

I insert " in the content box, but my db sends back an error -- any ideas on how to fix this?

[DaveMaxwell]

Try this before you do the insert....

fstring = Replace(fString, """", """)

replace fstring with the variable you are trying to insert....

[meztec]

?? That seems to get rid of the quotes for good...
I want to be able to output the quotes if someone wants to view the content.

Plus, this happens with all characters... ' etc ...

[Husain]

Dave, I think you have got the quotes the wrong way.

You can try this:

fString = replace(fString, """, "&_quot;")
fString = replace(fString, "'", "''")

Remove the underscore in the &_quot;

[meztec]

Cheers...that was the trick.

What is the reasoning behind this?

[Husain]

Glad to know it worked!

The first line replaces the qotation mark with the HTML equivalent so that it can be displayed in an HTML page.

The second line inserts another single quote to prevent the SQL insert statement from ending abnormally. A single quote means that the string in the SQL statement has ended (when in fact it is a quote that your visitor typed as a part of the message!) Doubling the single quotes tells the Database Engine that there's more to come.

Simple, isn't it?

[meztec]

Thanks for that.

Now im having a similiar problem...this time I want to insert tags like <br><br> <p></p> into my html form that will then populate the db. But, it's coming back with errors about these tags.

How to prevent that?

[Husain]

What errors are you getting?