Near the top of our function, you'll notice that we use the replace function to change any single quote marks in our data into two single quote marks. This is because SQL interpreters will choke on any single quote marks that are embedded inside text strings. By changing a single quote into two single quotes, you ensure that the SQL interpreter will correctly embed a solitary single quote in the text. Listing D adds the code that handles both of these problems.
Null values are fairly simple to deal with.
If the field we receive is empty, we simply place NULL in the final SQL string. While this is simple, it's very important to note that this logic assumes that you've verified the form data before you get to this point. For example, if your database doesn't allow null values for fname , you should ensure that the user fills in this field before the data is ever submitted to your ASP code. Another problem is that sometimes you simply don't want a field included in your SQL statement. Listing D handles this by adding the omitFields parameter to our function.