ASP - how to remove single quote from user input text

Question

answer  = Request.Form("Text" & i) 

In a form a user inputs random text which is inserted into a database. Currently if the user puts in single quotes it creates an error. How do i remove just single quotes' from the users answer?

Solution 1

answer was to use ... Replace(answer, "'", "")

Solution 2

Right way to solve this problem is use parameters when inserting to database. instead of:

SqlCommand cmd = new SqlCommand("INSERT INTO TABLE VALUES ('" + answer + "')");

use

SqlCommand cmd = new SqlCommand("INSERT INTO TABLE VALUES (@answer)",answer);

Solution 3

Use

answer.Replace("\'", "");

The above will replace the Single quote.

Solution 4

' are escaped by doubling, i.e replacing ' with 2 x ' for example "Ralph''s".

However you are far better off using parametrized statements with command objects which will take care of that for you.

View more solutions