Solving the ' issue

From: PL (pblse2_at_yahoo.se)
Date: 12/05/03 

Date: Fri, 5 Dec 2003 15:56:01 +0100

What do you do when you inherit hundreds of pages of badly
written code with queries that has:

WHERE [ID Number] = '" & Request("ID") & "'"

all over the pages, I counted 555 matches just in one folder :-(

If it was just Request("ID") I could do a search and replace but there
are other parameters.

What can I do on the SQL Server side to secure it up so nothing really
can happen if they enter a single qoute in a parameter ?

Any suggestions appreciated.

PL.

Relevant Pages

  • Re: Access 2007: Creating a local relationship between two remote ODBC tables
    ... they'll make building queries easier, which, it seems to me, is what ... I can written code to read the fields and work out what ... relationship diagram, which I can do manually without generating the ... relationships in the MySQL backend, ...
    (comp.databases.ms-access)
  • How to convert records in expression fields in Forms to a table?
    ... I inherit an old simple database written in Access 2000 with many forms and ... queries that contain either "expression fields" or refer to a non existing ...
    (microsoft.public.access.forms)
  • views
    ... database views will not inherit the indexes ... of their underlying tables. ... So queries using indexes will ...
    (microsoft.public.sqlserver.server)
  • Re: views
    ... the queries will use indexes if the views-- Base table have the ... necessory indexes in place. ... database views will not inherit the indexes ...
    (microsoft.public.sqlserver.server)