Insert into statement with an apostophe using VBA?

Question

I have a form with textboxes. I am inserting what the user enters into the textbox into a table. If the user enters an apostrophe in the textbox labeled "Me.ProjectName", I get an error. My code is:

   CurrentDb.Execute "INSERT INTO Table1(ProjectNumber, Title) " & _
        " VALUES('" & ProjectNumber & "','" & Me.ProjectName & "')"

Answer 1

You should not construct and execute dynamic SQL based on user input. You should use a parameterized query , something like:

Dim cdb As DAO.Database
Set cdb = CurrentDb
Dim qdf As DAO.QueryDef
Set qdf = cdb.CreateQueryDef("", _
        "INSERT INTO Table1 (ProjectNumber, Title) VALUES (@prjnum, @title)")
qdf.Parameters("@prjnum").Value = ProjectNumber
qdf.Parameters("@title").Value = me.ProjectName
qdf.Execute

Answer 2

You should escape your strings possibly containing quotes by replacing a quote with 2 quotes:

  Dim SQL As String

  SQL = "INSERT INTO Table1(ProjectNumber, Title) " & _
    " VALUES('" & ProjectNumber & "','" & Replace(Me.ProjectName, "'", "''")  & "')"

  CurrentDb.Execute SQL