No escape character with dircect method call in cfquery

[Lion_b1]

Hello,

I found the follwing behavior when I tried to use a method call directly in a
<cfquery>.
In this case single quote characers will not be escaped.

Is it a bug or a feature?

Example:

#variables.login_name# => O'Hara

Problems (no escape of ' ) with:
(SQL Syntax error or access violation: You have an error in your SQL syntax
near ....)

<cfquery datasource="test" name="ins">
INSERT INTO at02_admin
( login_name )
VALUES
( '#StringReturn.teststring(variables.login_name)#' )
</cfquery>


O.K with
<cfquery datasource="test" name="ins">
INSERT INTO at02_admin
( login_name )
VALUES
( '#variables.login_name#' )
</cfquery>

The comonent is defined (for testing only) like
<cfcomponent displayname="StringReturn">
<cffunction name="teststring">
<cfargument name="sString" type="string" required="true" >
<cfset var sTest = ARGUMENTS.sString />
<cfreturn sTest >
</cffunction>
</cfcomponent>

Please let me know if someone is having similar problems.

Thanks.

Bernhard

[eastinq]

Have you tried using the PreserveSingleQuotes() function in your Insert statement?

[paross1]

Have you tried using CFQUERYPARAM for your insert value.

Phil