writing quotes to database

[Netfreaky]

When you type a quote in a name for example, the database is returning
an error...
Now i only check the name field and replace every quote to \'

Is there a simple thing to replace all special characters with
something that can be inserted into a database?

I'm using asp.net with VB, and a MySQL database (using SQL server also
gives errors)

 

[Steve C. Orr [MVP, MCSD]]

You should use ADO.NET parameter objects. They will solve this problem and
similar problems and protect you against SQL Injection Attacks.
Here's more info:
http://msdn.microsoft.com/library/d...rfsystemdataoledboledbparameterclasstopic.asp
us/dv_vbcode/html/vbtskcodecallingparameterizedstoredprocedurevisualbasic.as
p

 

[Kikoz]

Use parameters, man

 

[Curt_C [MVP]]

replace it with '' (that's two single quotes) not \'