cfquery not escaping single quotes correctly

[Gregd66]

It seems as if two single quotes together do not get escaped.

<!---
This code works in CF5 with the proper Data OK message.
It does not work on MX7 using an oracle jdbc or native driver.
If you look at the debug of the insert statement you will see it
is not escaped correctly. CF is suppossed to escape it automatically.
--->


<cfset dsn="testdsn">
<cfset mydata="'' '"> <!--- if you put a character between the first 2 single
quotes it will work in MX7 ???? --->

<cfquery name="selectdata" datasource="#dsn#">
truncate table temp_table
</cfquery>

<cfquery name="inserttest" datasource="#dsn#">
insert into temp_table
(testdata)
values
('#mydata#')
</cfquery>

<cfquery name="selectdata" datasource="#dsn#">
select testdata
from temp_table
</cfquery>

<cfoutput>
<cfif selectdata.testdata neq mydata>
ERROR: DB data #selectdata.testdata# does not match original #mydata#
<cfelse>
Data OK.
</cfif>
</cfoutput>

[jonwrob]

Originally posted by: Gregd66
It seems as if two single quotes together do not get escaped.

<cfquery name="inserttest" datasource="#dsn#">
insert into temp_table
(testdata)
values
('#mydata#')
</cfquery>

Bad programming practice. Use:

<cfquery name="inserttest" datasource="#dsn#">
insert into temp_table
(testdata)
values
( <cfqueryparam cfsqltype="CF_SQL_LONGVARCHAR" value="#mydata#"> )
</cfquery>

Good programming practice. Also resolves your quotes issue.

JR