Building/Issueing a query with a field with a quote in it?

Using a language that using A4GL to connect to the database. From within the language(COBOL) we have the ability to add a simple query. All is fine with one exception. Some of the fields might have a quote mark in it.
we have a field in particular that a lot of our clients like to put an apostrophe in. such as 0001A'06, 2'11" and so on. Now from inside our programs and using the simple query we add something like 'where ap_id = '0001A'06' which i know is an error but is there a way around this or a way to make it work?You can use REPLACE on the string to change each single quote to two single quotes (NOT the "double-quote" character). But is looks like you are using direct dynamic SQL, and that is an invitation to SQL injection security attacks.|||That works all we have to do now is fix all of programs, (possible 800 or so).

Thanks again...|||COBOL and SQL Server?

It's an abomination I tells ya.....

Building an application on multiple data sources

ASP.NET on SQL Server

I've been asked to quote for developing a system to expose data on a
web application. Most of the data will come from SQL Server DBs
located on a single box. However, some of the data will be sourced
from ORACLE which is located on a different box. It may be necessary
to create VIEWS and Stored Procedures joining these DBs

Does anyone have any pointers, clues, hints, tips or pitfalls that I
might consider while making my proposal? What sort of extra
contingency should I allow for the connection to ORACLE? Should I do
all the data retrieval on the DB server, or should I do it on the Web
server?

Any thoughts would be appreciated.

Thanks

William BalmerWilliam wrote:

Quote:

Originally Posted by

ASP.NET on SQL Server
>
I've been asked to quote for developing a system to expose data on a
web application. Most of the data will come from SQL Server DBs
located on a single box. However, some of the data will be sourced
from ORACLE which is located on a different box. It may be necessary
to create VIEWS and Stored Procedures joining these DBs
>
Does anyone have any pointers, clues, hints, tips or pitfalls that I
might consider while making my proposal? What sort of extra
contingency should I allow for the connection to ORACLE? Should I do
all the data retrieval on the DB server, or should I do it on the Web
server?

Look into the Linked Server features of SQL server. You can link to the
Oracle db & run queries against the Oracle db thru SQL server. This may
reduce the maintenance - you'll only be writing in SQL Server syntax, or
calling SQL Server stored procedures that query the Oracle db.
--
MGFoster:::mgf00 <atearthlink <decimal-pointnet
Oakland, CA (USA)|||"Linked Server" can be one way to do this. However general network
latency and throughput restrictions due to bandwidth limitations or
network traffic, etc. can completely kill joins across the wire.

Also, be prepared to write views on the Oracle box to convert Oracle
data types to be more compatible with Sql Servers needs even using
linked servers.

Another option to consider it to "replicate" the data from the Oracle
box onto a Sql Server box, avoiding the need for joins across the wire.
This is the option I had to take to get acceptable performance for one
job I did.

William wrote:

Quote:

Originally Posted by

ASP.NET on SQL Server
>
I've been asked to quote for developing a system to expose data on a
web application. Most of the data will come from SQL Server DBs
located on a single box. However, some of the data will be sourced
from ORACLE which is located on a different box. It may be necessary
to create VIEWS and Stored Procedures joining these DBs
>
Does anyone have any pointers, clues, hints, tips or pitfalls that I
might consider while making my proposal? What sort of extra
contingency should I allow for the connection to ORACLE? Should I do
all the data retrieval on the DB server, or should I do it on the Web
server?
>
Any thoughts would be appreciated.
>
Thanks
>
William Balmer