Saving/Calling JS HTML with Single Quotes in SQL?

[csgaraglino]

I have been using SQL 200 for many years but now have a SQL 2008 server setup and all of my JavaScript is falling apart?

When I use ColldFusion9 to save HTML containing JavaScript with back-to-back quotes - SQL is deleting one of the quote marks?

IE:

input type="text"

     onfocus="if (this.value=='Enter Email for Ranchlands News') this.value='';this.style.color='grey';return;"

     onblur="if (this.value=='') this.value='Enter Email for Ranchlands News';this.style.color='grey';return;"

     value="Enter Email for Ranchlands News"

     name="email" class="email-sign-up-field"

This is a simple example form a clients form that is getting deconstructed - but I have many cases in complex JavaSctipt calls that are also falling apart.

I know that I can change his.value=='' to his.value==''' and it will save properly - but the next time a SAVE is preformed it strips out another quote rendering the code useless.

I have fixed quite a bit of the more complex pieces using calls to files - but for my non-programming clients (most all of them) that's not an option.

I need the ability to be able to let them send proper JS with two single quotes to SQL server regularly.

I have tried several SQL forums and they all say that I need to prep the code before submitting to SQL, so that's why I am posting here.

Any insight on how you guys have would be greatly appreciated!

[Reed_Powell-ttnmOb]

Can you show us your CF code that does the database INSERT?  CFQUERY automatically doubles-up the single quotes in the query so that there are no SQL syntax errors, but what goes into the actual table row is just the single quotes.  Using CFQUERYPARAM would also be advised to prevent injections.  If we can see your code then maybe we can figure out what is going on. 

You might want to write out to a text file (or use CFLOG if you also have access to the system logs) the contents of the form fields you are doing the database INSERTs on, just to verify that the strings you're passing to CFQUERY are what you expect, and are not already being doubled-up by some other code.