Issues with ' and %27

[Drew]

I am having difficulty fixing a problem with one of my apps. I know that
using an apostrophe will error the SQL statement out, since it thinks that
the apostrophe is the end of the statement. My issue is that I have replace
code in my app that is *supposed* to replace the apostrophe with double
quotes. This has been working fine, no complaints until a user tried to
insert the word, does'nt (I know, it is spelled incorrectly, but ASP
shouldn't care). The form data shows the line to be,

StaffHowToSpendTimeWork=Name+does%27nt+like...

Now my replace code looks like this,

dim StaffHowtToSpendTimeWork
StaffHowToSpendTimeWork = Request.Form("StaffHowToSpendTimeWork")
StaffHowtToSpendTimeWork = replace(StaffHowToSpendTimeWork,"'","''")

Is there a difference between ' and %27? How can I fix this?

Thanks,
Drew

 

[Evertjan.]

Drew wrote on 31 aug 2006 in microsoft.public.inetserver.asp.general:

I am having difficulty fixing a problem with one of my apps. I know
that using an apostrophe will error the SQL statement out, since it
thinks that the apostrophe is the end of the statement. My issue is
that I have replace code in my app that is *supposed* to replace the
apostrophe with double quotes. This has been working fine, no
complaints until a user tried to insert the word, does'nt (I know, it
is spelled incorrectly, but ASP shouldn't care). The form data shows
the line to be,

StaffHowToSpendTimeWork=Name+does%27nt+like...

Now my replace code looks like this,

dim StaffHowtToSpendTimeWork
StaffHowToSpendTimeWork = Request.Form("StaffHowToSpendTimeWork")
StaffHowtToSpendTimeWork = replace(StaffHowToSpendTimeWork,"'","''")

Is there a difference between ' and %27? How can I fix this?

Replace the apostroph with a single back quote [accent grave].

O'Brien -> O`Brien

[In screen output, you can (re)place the apostrophe back,
but it doesn`t bother me in Dutch]

 

[Bob Barrows [MVP]]

I am having difficulty fixing a problem with one of my apps. I know
that using an apostrophe will error the SQL statement out, since it
thinks that the apostrophe is the end of the statement.

That only happens if you are using dynamic sql. See here for a better
way:
http://groups-beta.google.com/group/microsoft.public.inetserver.asp.db/msg/72e36562fee7804e

My issue is
that I have replace code in my app that is *supposed* to replace the
apostrophe with double quotes.

Do you mean two apostrophes? That's the correct way to escape single
quotes in sql statements, not double quotes

This has been working fine, no
complaints until a user tried to insert the word, does'nt (I know, it
is spelled incorrectly, but ASP shouldn't care). The form data shows
the line to be,

StaffHowToSpendTimeWork=Name+does%27nt+like...

Huh? The user typed in "%27"?

Now my replace code looks like this,

dim StaffHowtToSpendTimeWork
StaffHowToSpendTimeWork = Request.Form("StaffHowToSpendTimeWork")
StaffHowtToSpendTimeWork = replace(StaffHowToSpendTimeWork,"'","''")

Is there a difference between ' and %27? How can I fix this?

Stop doing this replacement. Use parameters.