ASP recordset quotation mark trouble

Question

Hello everyone,
I've got a recordset that pulls sales data based on a
specific product that
is selected by the client from a dynamic dropdown of all the
products in the
database.
The trouble:
If the product name has quotation marks in it, no results are
returned.
If there are no quotation marks in the product name, results
are returned.
I thought everything was going fine during testing, until I
used quotation
marks in a product's name. The client enters the product
names as he or she
adds new ones to the database for this online store and
should be able to
use quotes.
This product name works: The Gadget
This one does not: The "Gadget"
The value from the dropdown used in the recordeset is named
product_Name.
I'm thinking the quotes being inserted into the SQL select
statement might
be the trouble ( WHERE product_Name = ? ), but I'm not sure.
Here's the relevant recordset code:
<%
Dim Recordset1__MMColParam
Recordset1__MMColParam = "1"
If (Request.QueryString("product_Name") <> "") Then
Recordset1__MMColParam = Request.QueryString("product_Name")
End If
%>
<%
Dim Recordset1
Dim Recordset1_cmd
Dim Recordset1_numRows
Set Recordset1_cmd = Server.CreateObject ("ADODB.Command")
Recordset1_cmd.ActiveConnection = MM_conn_box_STRING
Recordset1_cmd.CommandText = "SELECT cst_FirstName,
cst_LastName, order_ID,
order_Total, orderSKU_Quantity, product_Name FROM
cwq_OrderDetails WHERE
product_Name = ? ORDER BY cst_LastName ASC"
Recordset1_cmd.Prepared = true
Recordset1_cmd.Parameters.Append
Recordset1_cmd.CreateParameter("param1",
200, 1, 125, Recordset1__MMColParam) ' adVarChar
Set Recordset1 = Recordset1_cmd.Execute
Recordset1_numRows = 0
%>
<%
Dim Repeat1__numRows
Dim Repeat1__index
Repeat1__numRows = -1
Repeat1__index = 0
Recordset1_numRows = Recordset1_numRows + Repeat1__numRows
%>
Here's the relevant dynamic dropdown page's code.
The dropdown works fine, but if needed this shows where the
product name
used in the select statement comes from.
<%
Dim eventlist
Dim eventlist_cmd
Dim eventlist_numRows
Set eventlist_cmd = Server.CreateObject ("ADODB.Command")
eventlist_cmd.ActiveConnection = MM_conn_box_STRING
eventlist_cmd.CommandText = "SELECT DISTINCT product_Name
FROM
cwq_OrderDetails2 WHERE product_Archive = 0 ORDER BY
product_Name ASC"
eventlist_cmd.Prepared = true
Set eventlist = eventlist_cmd.Execute
eventlist_numRows = 0
%>
<form name="form1" method="get"
action="eventresults.asp">
<label>Events
<select name="product_Name" id="allevents">
<option value="">(select an event)</option>
<%
While (NOT eventlist.EOF)
%><option
value="<%=(eventlist.Fields.Item("product_Name").Value)%>"><%=(eventlist.Fields.Item("pro duct_Name").Value)%></option>
<%
eventlist.MoveNext()
Wend
If (eventlist.CursorType > 0) Then
eventlist.MoveFirst
Else
eventlist.Requery
End If
%>
</select>
</label>
<input name="button" type="submit" class="formButton"
id="button" value="
View Now ">
</form>
Thank you for taking a look.
Take care,
Tim

Answer 1

Thanks Matthew,
I had thought about &quot but that would actually make
for a lot of work in changing other parts of the application. It
would cause some problems with a couple of reports the application
generates and exports as far as naming conventions as well as order
confirmation emails and invoices that are automatically sent.
Also, I honestly would rather not have to tell clients they
need to enter code in. I've had a couple of folks who had very
little experience with computers. Showing them how to upload a
product image in a very user friendly admin section was difficult.
I can't image trying to explain why they need to enter code instead
of just typing The "Gadget" in the box that say's "Enter your
product name".
Thanks for taking a look, and I actually have a less complex
app where that might work nicely :-)
Take care,
Tim