Long story short, I'm using text gathered by a website form that users type in that can contain ANYTHING and putting it into XML, importing it into a VB.NET app, rearranging it, and then importing it into an Access database. People apparently love typing stuff with double quotes and single quotes and asterisks and all that for their name and their dog's name and their address.
To get those characters safe in the first place to use PHP to put them in a MYSQL database online, the person in control of the web side used a function to replace them all with something looking similar to HTML entity codes. Like & turns into &amp; and ' into &apos;. So my VB app has to change them back but when it does, some of those characters blow up my SQL statements. So far I've narrowed most problems down to apostrophes aka single quotes and I heard that's the only character that Access/SQL in general can't handle cuz that's what it uses to determine the start and end of strings. I heard the trick is to replace one single quote with two single quotes cuz that's the escape character. So all I have to do is loop through the whole table and change ' to '' and it should be able to handle all other wacky characters like < and | and " right? But I'm pretty sure my SQL statements containing an asterisk inside a string value make the database throw back an error too. Do I use the same escape character and replace * with '* or does that not work? And are there any other characters I need to handle?