Question: I'm using SQL Server 2005 with classic ASP and on a form repost (I post back to the same page), I replace each text field as follows:

```
course = trim(replace(request("course"),"'","''"))\

```

The problem with this is if I have to repost the form multiple times in case of validation errors, the tick marks I replace multiply.

Is there another way to safely vet the string fields without doing this kind of replace?

Answer: 
The easiest way would be to only do the SQL escaping when you're actually inserting into the database:

```
course = trim(request("course"))

```

Make a SafeSQL function:

```
function SafeSQL(TempStr)
    SafeSQL = Replace(TempStr,"'","''")
end function

```

Then, when you're inserting:

```
"INSERT INTO table(course) VALUES ('" & SafeSQL(course) & "')"

```

Disclaimer: I only have a working knowledge of ASP, I don't really know the best practices.
you can do this

course = trim(replace(request("course"),"'","&apos ;"))