Passing special characters to a SQL Server stored procedure

Question

I have an encryption routine that generates an encrypted string from 2 variables. This string may or may not contain "special characters". The ones in particular that give me trouble are apostrophes and brackets.

I currently use the [ ] to encapsulate the argument in my execute command. But that doesn't always work.

Does anyone have a good solution to try and stop the error from getting thrown when and end bracket gets assigned?

Answer 1

Have you tried with verbatim literal strings?

@"\somestring""";

http://www.dotnetperls.com/string-literal

Answer 2

The easiest solution would just be to escape apostrophes in your input string:

thePWD = encrypt(request("ap"), request("al"))
set rs = cn.execute("EXEC UpdateUser @uu_pswrd='" & replace(thePWD, "'", "''") & "'")

A more robust way of handling this would be to add proper parameter handling to your code. This may not be exactly right, since it's been a while since I've done this with VBA/VB6, but it should get you close:

thePWD = encrypt(request("ap"), request("al"))

set cmd = New ADODB.Command
cmd.ActiveConnection = cn
cmd.CommandText = "UpdateUser"
cmd.CommandType = "StoredProcedure"
cmd.Parameters.Add(
  cmd.CreateParameter("@uu_pswrd", adVarChar, , 255, thePWD))
set rs = cmd.execute