Sql injections

[humair]

Hi
I wana to write form validation in ASP tp safe from SQL specific character
Like
in form input field user write : "one two three and '"
this "'" is make a problem when running that in ASP to insert a data in SQL Server.
how can i safe this.
i wana to write all that kind of SQL Specific script?
Regards
Humair

[Webforumz Staff]

Right, I'm not entirely sure what you're asking here, but for the benefit of others I think you're asking about stripping out ' and " from user Input so that it cannot cause problems when running it in an SQL statement?

[D3mon]

use the replace() function e.g.

strFormData = replace(request.form("[data]"),"'","")

[Smokie]

Simply replace all singles quotes with 2 single quotes, this way you will not get an error and (I think) you will also be safe from SQL injection attacks. Example:

Code: Select all

strFormData = replace(request.form("[data]"),"'","''")