I'm passing parameters to an XMod page to search a database, sometimes a search parameter will be O'Reilly which messes up the SQL Query.

Here is the XMod code:

<ListDataSource CommandText="SELECT ID, CharityName, City, RAScore, Province, Country, MissionStatement, RegistrationNum, RAScore FROM CharityProfiles WHERE RAScore is not null AND CharityName like '' + @SearchName + '' AND CharityType like '' + @SearchType + '' AND Province like '' + @Province + '' Order by ABS(RAScore) ">

<parameter name="SearchName" value='[[Url:Name]]' />
<parameter name="SearchType" value='[[Url:Type]]' />
<parameter name="Province" value='[[Url:Prov]]' />

</ListDataSource>

How can I replace the "'" character with a "''" character in the SearchName or Url:Name??

I think if you use a stored procedure instead of embedded SQL you will not have a problem.

I have a site that sends some free text to a url parameter and filters a template.

I tried it with "O'Reilly" and it searched fine. The parameter came back into the search form with
two apostrophes. So O'Reilly became O''Reilly which means the SP added the extra apostrophe.

gus