CFMX7 and dynamic query --Need to maintain single quotes

[DixieGal]

I have a cfquery select that is built from a search form.

When the form is processed, it builds a searchstring like this:
<cfset searchstring = searchstring & " and dbcolumn1 like '%#form.field1#%'
">
<cfset searchstring = searchstring & " and dbcolumn2 like '%#form.field2#%'
">

(checking to for non-empty form fields to when building the search string)

So my searchstring is a str var containing values similar to this:
and dbcolumn1 like '%#form.field1#%' and dbcolumn2 like '%#form.field2#%'


My query is:
<cfquery name='myquery' datasource=....>
select * from table where displayme=1 and #searchstring#
</cfquery>

It all seems to resolve well, except at the SQL level, the command gets
converted from single quotes ('%#form.field1#%') to double quotes
("%#form.field2#%").
Using the doublequotes hozes up the select and the query isn't evaluated
properly.

Is there an elegant way to maintain the single quotes? I could plug in the
ASCII value for them, but
this doesn't seem to be an issue in CFML5 so I wasn't prepared for it in
this new version...
Please respond here or email me.. I am definitely stuck :)
--
Tami
aka DixieGal

**************************
So it is that the gods to dno give all men gifts of grace - neither good
looks not intelligence nor eloquence...
--Homer, The Odyssey
**************************

[Mountain Lover]

PreserveSingleQuotes()
better yet: cfqueryparam
HTH
--
Tim Carley
[url]www.recfusion.com[/url]
[email]info@NOSPAMINGrecfusion.com[/email]

[DixieGal]

duh!
I tried cfqueryparam, but the query still got choked
Thanks Tim!
LOL, Tami
"Mountain Lover" <info@NOSPAMrecfusion.com> wrote in message
news:di6i07$ltf$1@forums.macromedia.com...
| PreserveSingleQuotes()
| better yet: cfqueryparam
| HTH
| --
| Tim Carley
| [url]www.recfusion.com[/url]
| [email]info@NOSPAMINGrecfusion.com[/email]

[mxstu]

Mountain Lover's right. Use cfqueryparam if you can because although
PreserveSingleQuotes() works, it can pose a sql injection risk. Using
cfqueryparam may also increase performance in certain situations.

[DixieGal]

Yep, let me try again. I use cfqueryparam for all my other sql stmts,so
am very familiar with it.... if I have to bang the statement out with
a preservesinglequotes() inside cfqueryparam, I will ...

Thanks guys... too little coffee... and too little brain power today. Must
be all
the rain outside :)
Tami
"mxstu" <webforumsuser@macromedia.com> wrote in message
news:di6kv0$q2t$1@forums.macromedia.com...
| Mountain Lover's right. Use cfqueryparam if you can because although
| PreserveSingleQuotes() works, it can pose a sql injection risk. Using
| cfqueryparam may also increase performance in certain situations.
|