[Last Call] Learn about multicloud storage options and how to improve your company's cloud strategy. Register Now

x
?
Solved

INSERT SQL Statement fails when name field contains an apostrophe

Posted on 2009-04-08
11
Medium Priority
?
252 Views
Last Modified: 2013-11-26
I am using VB.NET and Visual Studio to develop a windows form application.  One of the functions involves reading data from an external file into an MS Access Table that is created programatically.  The problem that I'm having is if the name field contains an ' the SQL Statement fails.  When using a table defined in my dataset, I can enter names wilth ' and it takes it with no error.  How can I get ' to be accepted in my SQL statement?  The code is listed below.  Error message is:

syntax error (missing operator) in query expression ''Le'Bue','12345678','200815','ACTUAL HOURS WORKED',#7/18/2008#,71.9,'DUES FT')'.
Public Function InsertHours(ByVal tblName As String) As Boolean
 
        'Define the connectors
        Dim oConn As OleDbConnection
        Dim oComm As OleDbCommand
        Dim oConnect, oQuery As String
        Dim recAffected As Integer = 0
 
        'Define connection string
        oConnect = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=pfms.mdb"
 
        'Define the query string the creates the table
        oQuery = "INSERT INTO " & tblName & " (SSN, Fname, Lname, PersNo, Payroll, WageType, PaymentDate, Hours, EmpType) "
        oQuery = oQuery & "values('" & SSN & "', '" & FirstName & "', '" & LastName & "', '" & PersNo & _
                    "', '" & PayrollPeriod & "', '" & WageType & "', #" & PaymentDate & "#, " & Hours & ", '" & EmployeeType & "')"
 
        ' Instantiate the connectors
        oConn = New OleDbConnection(oConnect)
        oComm = New OleDbCommand(oQuery, oConn)
 
        'Try connecting and crate the table
        Try
 
            'Open the connection
            oConn.Open()
 
            'Perform the Non-Query
            recAffected = oComm.ExecuteNonQuery()
 
            'Close the connection
            oConn.Close()
 
        Catch ex As OleDb.OleDbException
            'Show error message and return failure
            MsgBox(ex.Message & vbCrLf & ex.StackTrace)
            Return False
        Catch ex As Exception
 
            'Show error message and return failure
            MsgBox(ex.Message & vbCrLf & ex.StackTrace)
            Return False
 
        Finally
 
            'Dispose the connector objects
            If Not (oConn Is Nothing) Then
                oConn.Dispose()
                oConn = Nothing
            End If
            If Not (oComm Is Nothing) Then
                oComm.Dispose()
                oComm = Nothing
            End If
 
        End Try
 
        'Return success
        If recAffected = 1 Then
            Return True
        Else
            Return False
        End If
 
    End Function

Open in new window

0
Comment
Question by:dyarosh
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
11 Comments
 
LVL 53

Expert Comment

by:Ryan Chong
ID: 24103796
try double the apostrophe for Char fields, like:

SSN = SSN.Replace("'","''")
FirstName = FirstName.Replace("'","''")

....


before:

oQuery = "INSERT INTO " & tblName & " (SSN, Fname, Lname, PersNo, Payroll, WageType, PaymentDate, Hours, EmpType) "
0
 
LVL 75
ID: 24103800
Try surrounding the items with double quotes instead of single quotes.

mx
0
 
LVL 65

Expert Comment

by:rockiroads
ID: 24104347
have you tried using parameter queries instead?

You could use Convert.ToChar(34) to wrap in ddouble quotes instead of single quotes. Example below just wraps with the two name fields

        oQuery = "INSERT INTO " & tblName & " (SSN, Fname, Lname, PersNo, Payroll, WageType, PaymentDate, Hours, EmpType) "
        oQuery = oQuery & "VALUES ('" & SSN & "', " & Convert.ToChar(34) & FirstName & Convert.ToChar(34) & ", " & Convert.ToChar(34) & LastName & Convert.ToChar(34) & ", '" & PersNo & _
                    "', '" & PayrollPeriod & "', '" & WageType & "', #" & PaymentDate & "#, " & Hours & ", '" & EmployeeType & "')"

0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 
LVL 65

Accepted Solution

by:
rockiroads earned 2000 total points
ID: 24104607
A very simple example using parameters, It saves you having to worry about quotes.

'Define query, place ? where you need to put in your variables
        Dim sSql As String = "INSERT INTO tblTest (Field1, Field2, Field3) VALUES (?, ?, ?)"

'In your command object, add parameters like this. Field1, Field2, Field3 represent column names you want to fill. You just need to specify datatype
        Dim command As New OleDbCommand(sSql, conn)
        command.Parameters.Add("@Field1", OleDbType.Char).Value = "Mango"
        command.Parameters.Add("@Field2", OleDbType.Char).Value = "Chutney"
        command.Parameters.Add("@Field3", OleDbType.Numeric).Value = 99

0
 
LVL 65

Expert Comment

by:rockiroads
ID: 24104618
urm, forgot to give credit to mx regarding using double quotes. If u go that approach, use Convert.ToChar
0
 
LVL 83

Expert Comment

by:CodeCruiser
ID: 24105811
By the way, the reason for error is that appostrophe ' is used to enclose char values in SQL so SQL expects a pair of ' ' enclosing a char/string value but in your case the closing ' is missing hence the error.
0
 

Author Comment

by:dyarosh
ID: 24106921
When trying to use parameters, I'm getting a syntax error on my Insert command.  I'm not sure what I'm doing wrong.  I've included a copy of the code.  To try and find the problem, I reduced the insert statement to:
oQuery = "INSERT INTO " & tblName & " (SSN) Values(?)"

oConn = New OleDbConnection(oConnect)
oComm = New OleDbCommand(oQuery, oConn)
oComm.Parameters.Add("@SSN", OleDbType.Char).Value = SSN
The error I'm getting is shown in the attached file.
 

Public Function InsertHours(ByVal tblName As String) As Boolean
 
        'Define the connectors
        Dim oConn As OleDbConnection
        Dim oComm As OleDbCommand
        Dim oConnect, oQuery As String
        Dim recAffected As Integer = 0
 
        'Define connection string
        oConnect = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=pfms.mdb"
 
        'Define the query string the creates the table
        oQuery = "INSERT INTO " & tblName & " (SSN) " & _
                    "Vaules (?)"
 
        ' Instantiate the connectors
        oConn = New OleDbConnection(oConnect)
        oComm = New OleDbCommand(oQuery, oConn)
        oComm.Parameters.Add("@SSN", OleDbType.Char).Value = SSN
 
        'Try connecting and crate the table
        Try
 
            'Open the connection
            oConn.Open()
 
            'Perform the Non-Query
            recAffected = oComm.ExecuteNonQuery()
 
            'Close the connection
            oConn.Close()
 
        Catch ex As OleDb.OleDbException
            'Show error message and return failure
            MsgBox(ex.Message & vbCrLf & ex.StackTrace)
            Return False
        Catch ex As Exception
 
            'Show error message and return failure
            MsgBox(ex.Message & vbCrLf & ex.StackTrace)
            Return False
 
        Finally
 
            'Dispose the connector objects
            If Not (oConn Is Nothing) Then
                oConn.Dispose()
                oConn = Nothing
            End If
            If Not (oComm Is Nothing) Then
                oComm.Dispose()
                oComm = Nothing
            End If
 
        End Try
 
        'Return success
        If recAffected = 1 Then
            Return True
        Else
            Return False
        End If
 
    End Function

Open in new window

inserterror.png
0
 
LVL 65

Expert Comment

by:rockiroads
ID: 24106938
spelling of Values?
0
 
LVL 65

Expert Comment

by:rockiroads
ID: 24106942
Also location of db. Just specifying db name, I would assume it would be current path, so you might wanna put full path
0
 

Author Closing Comment

by:dyarosh
ID: 31568361
Thanks for your help.  Don't know how many times I looked at the Insert statement and still did not see that I misspelled Values.
0
 
LVL 65

Expert Comment

by:rockiroads
ID: 24107198
No worries. Using the parameters makes life easier especially for the longer sql statements.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

AutoNumbers should increment automatically, without duplicates.  But sometimes something goes wrong, and the next AutoNumber value is a duplicate.  This article shows how to recover from this problem.
Code that checks the QuickBooks schema table for non-updateable fields and then disables those controls on a form so users don't try to update them.
In Microsoft Access, learn the trick to repeating sub-report headings at the top of each page. The problem with sub-reports and headings: Add a dummy group to the sub report using the expression =1: Set the “Repeat Section” property of the dummy…
Do you want to know how to make a graph with Microsoft Access? First, create a query with the data for the chart. Then make a blank form and add a chart control. This video also shows how to change what data is displayed on the graph as well as form…
Suggested Courses

650 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question