Solved

Apostrophe Error in SQL matching

Posted on 2004-08-11
8
333 Views
Last Modified: 2013-12-25
I have used code similar to the following to search for matching records in a database, and it works well, providing a narrowing list of matches as the 'Search' texts gets longer.

Variables FtExt1 and FtExt2 are the contents of the two Search text boxes, and the code is called to update the Recordset after every change in either text box.

The problem occurs when the Search text includes an APOSTROPHE eg O'Carrol. This is because SQL uses the apostrophe for its' own purposes, and this extra apostrophe destroys the logic of the SQL.

If the user types an Apostrophe, the program crashed, until I added code to trap this character


    SQL = "Select [ID], [Title], [Name], Age FROM Entrants WHERE ([Title] like '" & FtExt1 & "' OR [Title] is Null) AND ([Name] like '" & FtExt2 & "') ORDER BY 3,2;"
    MatchingRs.Open SQL, SMConn, adOpenKeyset, adLockReadOnly

This problem is not a large one, but does restrict the scope of my 'Find' routine to some extent.

Is there a way to include the apostrophe in the SQL without crashing it

thanks

nedwob
0
Comment
Question by:nedwob
8 Comments
 
LVL 69

Assisted Solution

by:Éric Moreau
Éric Moreau earned 30 total points
Comment Utility
You have to double it:

 SQL = "Select [ID], [Title], [Name], Age FROM Entrants WHERE ([Title] like '" & replace(FtExt1, "'","''") & "' OR [Title] is Null) AND ([Name] like '" & replace(FtExt2,"'", "''") & "') ORDER BY 3,2;"
0
 
LVL 6

Assisted Solution

by:bkthompson2112
bkthompson2112 earned 30 total points
Comment Utility
Hi nedwob,

Use 2 apostrophes.  ''
When the user enters an apostrophe add another to the search string.

bkt
0
 
LVL 29

Accepted Solution

by:
leonstryker earned 80 total points
Comment Utility
You may want to use a function to do this to all of your SQl string before passing them to the database.  Here is sample function which does it:

http://www.experts-exchange.com/Programming/Programming_Languages/Visual_Basic/VB_Databases/Q_20602507.html

Leon
0
 
LVL 6

Assisted Solution

by:PePi
PePi earned 50 total points
Comment Utility
use replace like so:


SQL = "Select [ID], [Title], [Name], Age FROM Entrants WHERE ([Title] like '" & Replace(FtExt1,"'","''") & "' OR [Title] is Null) AND ([Name] like '" & Replace(FtExt2,"'","''") & "') ORDER BY 3,2;"


in the replace function, the second parameter is a double quote, single quote, double quote
the third parameter is a double quote,  a single quote, another single quote then a double quote.

it's very hard to see the difference of these single & double quotes just by looking at it. hope this helps
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 8

Assisted Solution

by:mladenovicz
mladenovicz earned 70 total points
Comment Utility
Public Function m_PrepareQueryParams(str As String) As String
Dim sRes As String
   
    sRes = str
   
    sRes = Replace(sRes, "[", "[[]")
    sRes = Replace(sRes, "*", "[*]")
    sRes = Replace(sRes, "?", "[?]")
    sRes = Replace(sRes, "#", "[#]")
    sRes = Replace(sRes, "%", "[%]")
    sRes = Replace(sRes, "_", "[_]")
    sRes = Replace(sRes, "'", "''")
   
    m_PrepareQueryParams = sRes
   
End Function
0
 

Author Comment

by:nedwob
Comment Utility
Thanks for the comments. I will look at them and come back to award the points in a day or two.

nedwob
0
 
LVL 18

Assisted Solution

by:JR2003
JR2003 earned 40 total points
Comment Utility
I use a function called DBStr and call it with every string I put into some sql.
Just paste the function into a module and call it from all the literals you put in sql.
It works a treat...

'Example Usage:
===========

 SQL = "Select [ID], [Title], [Name], Age FROM Entrants WHERE ([Title] like '" & DBStr(FtExt1) & "' OR [Title] is Null) AND ([Name] like '" & DBStr(FtExt2) & "') ORDER BY 3,2;"



'Function:
'======

Public Function DBStr(sIn As String) As String

    Dim tmp As String
    Dim i As Long
    Dim j As Long
   
    If Len(sIn) <> 0 Then
        j = 1
        Do
            i = InStr(j, sIn, "'")
            If i = 0 Then Exit Do
            tmp = tmp & Mid$(sIn, j, i - j) & "''"
            j = i + 1
        Loop
        DBStr = tmp & Mid(sIn, j)
    End If
   
End Function

0
 

Author Comment

by:nedwob
Comment Utility
Thanks to all. I have increased the points and will split according to the input or usefulness to me.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Introduction While answering a recent question (http://www.experts-exchange.com/Q_27402310.html) in the VB classic zone, I wrote some VB code in the (Office) VBA environment, rather than fire up my older PC.  I didn't post completely correct code o…
The debugging module of the VB 6 IDE can be accessed by way of the Debug menu item. That menu item can normally be found in the IDE's main menu line as shown in this picture.   There is also a companion Debug Toolbar that looks like the followin…
As developers, we are not limited to the functions provided by the VBA language. In addition, we can call the functions that are part of the Windows operating system. These functions are part of the Windows API (Application Programming Interface). U…
Get people started with the process of using Access VBA to control Outlook using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Microsoft Outlook. Using automation, an Access applic…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now