VBScript Code breaking from String containing '

Question

one of my user has a \' inside the user name and i think that it is breaking the login code on the line tempPassword=Request.Form(\"UserPassword\")

if (Req         


        

Answer 1

Don't use string concatenation for building SQL queries. Ever. Not only will you encounter problems like this, it will also make you vulnerable to SQL injection. Use parameterized queries (AKA prepared statements) instead:

Set cmd  = CreateObject("ADODB.Command")
cmd.ActiveConnection = cn

Set p1 = cmd.CreateParameter("@email" , 200, 1, 255, tempUsername)
cmd.Parameters.Append p1
Set p2 = cmd.CreateParameter("@password" , 200, 1, 255, tempPassword)
cmd.Parameters.Append p2

cmd.CommandText = "SELECT ContactID,Email,Password FROM Directory " _
  & "WHERE Email=? AND Password=?"

Set rsQuery = cmd.Execute