Error when user submits form with ; in value

[tdmailbox@yahoo.com]

I have a function that hashs the value that a user entered in a text
box and stored that hash value as a password. All is well unless a
user enters a password that when hased has a ; in it.

If a user entered 33333333 as the password my hash function returns a
value that includes a ; and then the DoCmd.RunSQl fails.

Is there a good way of fixing this? Since it is a hash of the password
I was thinking of maybe just running a function that replaces the ;
with another character before saving the value into the database.

my question is what would be the best way to do this? Also are there
any characters that I need to worry about?

txtUSERPWD_NEW_ HASH = HashString(txtU SERPWD_NEW)

DoCmd.SetWarnin gs False

DoCmd.RunSQL "UPDATE T_USER SET T_USER.USERPWD= '" & txtUSERPWD_NEW_ HASH
& "' WHERE T_USER.USERID=' " & txtUSERID & "' ;"
DoCmd.SetWarnin gs True

[MGFoster]

Re: Error when user submits form with ; in value

tdmailbox@yahoo .com wrote:[color=blue]
> I have a function that hashs the value that a user entered in a text
> box and stored that hash value as a password. All is well unless a
> user enters a password that when hased has a ; in it.
>
> If a user entered 33333333 as the password my hash function returns a
> value that includes a ; and then the DoCmd.RunSQl fails.
>
> Is there a good way of fixing this? Since it is a hash of the password
> I was thinking of maybe just running a function that replaces the ;
> with another character before saving the value into the database.
>
> my question is what would be the best way to do this? Also are there
> any characters that I need to worry about?
>
> txtUSERPWD_NEW_ HASH = HashString(txtU SERPWD_NEW)
>
> DoCmd.SetWarnin gs False
>
> DoCmd.RunSQL "UPDATE T_USER SET T_USER.USERPWD= '" & txtUSERPWD_NEW_ HASH
> & "' WHERE T_USER.USERID=' " & txtUSERID & "' ;"
> DoCmd.SetWarnin gs True
>[/color]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Using Access 2002 (ANSI-92 SQL) I couldn't replicate the error. Here's
what I did:

strPWD = HashString(Me!t xtUSERPWD_NEW)

strSQL = "UPDATE T_USER SET USERPWD='" & strPWD & "'" & _
"WHERE USERID='" & Me!txtUSERID & "'"

CurrentDb.Execu te strSQL, dbFailOnError

--
MGFoster:::mgf0 0 <at> earthlink <decimal-point> net
Oakland, CA (USA)

-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBQhk/Q4echKqOuFEgEQI BiACeOXO+9r3T0G 4qPejpJ0FSamp3X 0wAmwXV
Hfzj4h5JniT5yow QNujo1MHS
=qaLx
-----END PGP SIGNATURE-----

[tdmailbox@yahoo.com]

Re: Error when user submits form with ; in value

I tried modifying the code so that the ' was moved out inside a
seperate set of " "

However, I still run into the same issue where when
txtUSERPWD_NEW_ HASH contains a ;

This makes sense as a ; ends a line of SQL code.


T_USER.USERPWD= '" & txtUSERPWD_NEW_ HASH & "'" & "WHERE T_USER.USERID=' "
& txtUSERID & "' ;"

[pietlinden@hotmail.com]

Re: Error when user submits form with ; in value

then you could, I suppose, open an updatable recordset with just one
record in it and do this...

rs.Open "..."
rs.Edit
rs.Fields("Pass word")=HashStri ng(Me!txtUSERPW D_NEW)
rs.Update