SQL syntax error

[Jon12345]

I am using some code that calls a MySQL database via an ODBC driver. This works fine but I am getting a SQL syntax error. I think it is happening on one of the lines of code below:

    SQLString = "Update Articles Set MSNFatBody = '" & NewName & "' Where (id = " & ArticleID & ")"
	msgbox SQLString
    set rsCustomers = MyDB.Execute(SQLString)CODE]

This got me thinking. What happens if the field MSNFatBody has a " or a ' in there? Would this cause the error? What about other illegal characters?

How do you get around this?

Thanks,

Jon

[bradgrafelman]

Eh, what is that, VBscript? I don't know if VB has a native escape/encode function, but I found one on this website. Just run the data inside the quotes through that function so that they are prepended with a backslash.

EDIT: Here is another page that talks about making user input safe for SQL querying.