Escaping quotes and injections

[fran7]

Hi, I wonder if someone could advise on the following.
I inherited this code, I am not a coder but have had some kind of hack and am looking at code to reduce its vulnerability. At the top of the page I have

	nPage = CLng(Request.QueryString("Page"))

	
	Keyword = Trim(Request.QueryString("Keyword"))

in the where clause I have

p.area LIKE '%" & Replace(Keyword, "_", " ") & "%'

I need to replace these for the query string, but do I also need to add an escape

p.area LIKE '%" & Replace(Keyword, "'", "''") & "%'

Thanks for any advice.
Richard

[Rabbit]

What do you mean by escape? Replacing single quotes with double single quotes is an escape for quotes. But if you want to truly protect against injection, you should use parameters instead.