Database update problem

[atgheb]

The following is the piece of code that is giving me problems. First of all I should mention that the code works fine. that is UNTIL I put an ' in the paragraph or heading form. Then it gives me the follwoing error:

Syntax error (missing operator) in query expression

if I enter ', in the paragraph or heading section it gives me a syntax error. Now I can see why I am having this problem. I was wondering if anyone knows any solution to this problem. Like i noticed that the form that I am entering the text in to make this posting accepts ' or even the ', combination. Any help is appriciate, the database is access, I am using VBscript and here is the code:

ID = Request.Form("ID")
sql="UPDATE " & tn & " SET paragraph = '" & Request.Form("paragraph") & "',"
sql= sql & "fontsizeis='" & Request.Form("fontsizeis") &"',"
sql= sql & "heading='" & Request.Form("heading") &"' "
sql= sql& "WHERE ID =" & ID

[ywhw]

not sure this is the answer, but before you place the variable in the query string search it (instr) for a ' , and replace with the character value chr(39)...

hope this helps.