Question: I'm using SQL Server 2005 with classic ASP and on a form repost (I post back to the same page), I replace each text field as follows:

```
course = trim(replace(request("course"),"'","''"))\

```

The problem with this is if I have to repost the form multiple times in case of validation errors, the tick marks I replace multiply.

Is there another way to safely vet the string fields without doing this kind of replace?

Answer: 
you better use a parametrized query:

```
dim cmd : set cmd = server.createObject("ADODB.Command")
dim param
dim sql : sql = "INSERT INTO table(course) VALUES (?)"
cmd.ActiveConnection = yourDBconnection
cmd.CommandType = adCmdText

set param = cmd.CreateParameter("course", adVarChar, , 20, request("course"))
cmd.Parameters.Append param

cmd.CommandText = sql
cmd.Execute

```

so you are completely safe with sql injection
Only replace the `'` for use in the sql string. (*which you should better do with parameterized queries..*)