🚀 go-pugleaf

"chrisgi" <chrisgi@omex.com> wrote in message 
news:47c43028$1@newsgroups.borland.com...
>
> can you explain what that is

If you are executing the query yourself then a parameterized query is 
something offered by SQL database servers to provide more efficiency - you 
only need to give it an SQL query once, and then you can execute it any 
number of times with different parameters just by passing the parameters 
instead of the entire query.

However, if you need to pass a complete script to another process then this 
won't work for you very well.

>           s.add (' VALUES ("' + account_number.Text     + '","'
>                               + controlcontrol_dsm.Text + '","'
>                               + sqldate                 + '","O","'
>                               + account_name.Text       + '","'
>                               + acc_address1.text       + '","'
>                               + acc_address2.text       + '","'
>                               + acc_address3.text       + '","'
>                               + acc_address4.text       + '","'
>                               + acc_postcode.Text       + '","'
>                               + acc_sec_mobile.text     + '","'

You are using double-quotes to delimit the values, but the SQL standard is 
to use single quotes. Double quotes are supposed to be used to indicate 
metadata such as table for field names. However, just changing that won't 
solve the problem of any of your values having embedded quotes. The solution 
to both is to use the QuotedStr function.

           s.add (' VALUES (' + QuotedStr(account_number.Text) + ','
                               + QuotedStr(controlcontrol_dsm.Text) + ','
                               + // etc...


-- 
Wayne Niddery - TeamB (www.teamb.com)
Winwright, Inc. (www.winwright.ca)