Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

ASP Unclosed quotes error message

Posted on 2007-03-27
3
Medium Priority
?
216 Views
Last Modified: 2011-10-03
I have an application that people can paste into an input box information from a Word Document.  The data gets posted to a SQL Server database.

However...if the text includes an apostrophe like this line

in one of Boca Raton's finest

Theres an error message.  What can I do to get it to accept the apostrophe?  Error message follows

Incorrect syntax near 's'.
Unclosed quotation mark after the character string ' where txtAdID=4134'.
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: System.Data.SqlClient.SqlException: Incorrect syntax near 's'.
Unclosed quotation mark after the character string ' where txtAdID=4134'.

Source Error:


Line 56:         sSQL = sSQL & " where txtAdID=" & Request.QueryString("txtAdID")
Line 57:         oCom2.CommandText = sSQL
Line 58:         oCom2.ExecuteNonQuery()
Line 59:         oCom2.Dispose()

 
0
Comment
Question by:lrbrister
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 37

Expert Comment

by:samtran0331
ID: 18802148
you should always use parameterized queries:
http://aspnet101.com/aspnet101/tutorials.aspx?id=1

doing sql like this:
sSQL = sSQL & " where txtAdID=" & Request.QueryString("txtAdID")

is bad...it leaves you open to sql injection attacks as well as problems like this with the apostrophe
0
 
LVL 37

Accepted Solution

by:
samtran0331 earned 2000 total points
ID: 18802165
here's another article on parameterized queries:
http://www.4guysfromrolla.com/webtech/092601-1.shtml

also, the first page gives you a "quick fix" for your apostrophe problem...but I'd highly recommend that you use parameterized queries and/or stored procedures
0
 

Author Comment

by:lrbrister
ID: 18802357
samtran0331
  This does get executed in a stored procedure.  But thanks for the info and the link
Points being awarded now
0

Featured Post

 [eBook] Windows Nano Server

Download this FREE eBook and learn all you need to get started with Windows Nano Server, including deployment options, remote management
and troubleshooting tips and tricks

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Just a quick little trick I learned recently.  Now that I'm using jQuery with abandon in my asp.net applications, I have grown tired of the following syntax:      (CODE) I suppose it just offends my sense of decency to put inline VBScript on a…
Problem Hi all,    While many today have fast Internet connection, there are many still who do not, or are connecting through devices with a slower connect, so light web pages and fast load times are still popular.    If your ASP.NET page …
In this video, Percona Solution Engineer Dimitri Vanoverbeke discusses why you want to use at least three nodes in a database cluster. To discuss how Percona Consulting can help with your design and architecture needs for your database and infras…
Are you ready to place your question in front of subject-matter experts for more timely responses? With the release of Priority Question, Premium Members, Team Accounts and Qualified Experts can now identify the emergent level of their issue, signal…

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question