Syntax Error (input character)

[werks]

Hello

Every time i input the character ' and % in the textfield it generate an error in my query.

The error:
Syntax error in query expression 'Title LIKE '%' %%';'.

My code:
[CODE=asp]
adoList.Open "SELECT * FROM qryOPAC WHERE Title LIKE '%" & varExp & "%';",CoNN, 3,3
[/CODE]

tnx in advance..

--
Kenneth
"Better Than Yesterday"

[jagged]

Hello

Every time i input the character ' and % in the textfield it generate an error in my query.

The error:
Syntax error in query expression 'Title LIKE '%' %%';'.

My code:
[CODE=asp]
adoList.Open "SELECT * FROM qryOPAC WHERE Title LIKE '%" & varExp & "%';",CoNN, 3,3
[/CODE]

tnx in advance..

--
Kenneth
"Better Than Yesterday"

Escape all single quotes...

WHERE Title LIKE '%" & Replace(varExp,"'","''") & "%';"

.


Btw, running dynamic sql with parts taken straight from user input opens you up to sql injection attacks...