Query is throwing error and I am not sure how to fix it

General
1 
// Variables defined here...
Var rsMore As RowSet
Var rsData As RowSet
sQrySrc = txtAcctNum.Text // This value will have a hyphen in it...

Var sSql As String = "SELECT highlight( vTblCustomer, 1, '', '' ) FROM vTblCustomer WHERE vTblCustomer MATCH'" + sQrySrc + "' ORDER BY address" // MATCH

// The code that does magical stuff...
Try
  rsData = srchDbse.SelectSQL( sSql )
Catch err As DatabaseException
  MessageDialog.Show("Error: " + err.Message)
  Return
End Try

When this runs if there is a hyphen in sQrySrc I get this error:
DataBase Exception: no such column: 07

An example of data that will be used is: 124305-07
So if I use that from a TextField the query won’t run. I even tried putting the value into a declared string but the results are the same.

2

can you try

MATCH '""" + sQrySrc + """' ORDER

and try to use arguments
db.SelectSQL("SELECT * FROM Customer WHERE PostalCode=?", PostalCode.Text)

3

You should never pass raw values directly into an SQL statement, as this is a vector for SQL injection based attacks. Try:
Var sSql As String = "SELECT highlight( vTblCustomer, 1, '', '' ) FROM vTblCustomer WHERE vTblCustomer MATCH ? ORDER BY address" // MATCH
var Vals() as Variant
vals.add sQrySrc
rsData = srchDbse.SelectSQL( sSql,valsO)
This creates a prepared SQL statement which is much safer. The ? marks are replace with the values in the Variant array.

4

Wow, learned something new! Thanks. I will work in implementing this shortly.