Visual Basic

Public Function CSQLQuote(ByVal Value As String) As String
'    Value = Replace(Value, "\", "\\")
'    CSQLQuote = Replace(Value, "'", "''")
    CSQLQuote = mysql_escape_string(Value)
End Function

'API DECLARATION FOR mysql_escape_string FUNCTION CALL
Public Declare Function api_mysql_escape_string Lib "libmySQL.dll" _
        Alias "mysql_escape_string" _
        (ByVal strTo As String, _
         ByVal strFrom As String, _
         ByVal lngLength As Long _
        ) As Long

Public Function mysql_escape_string(dirtystring As String) As String
    Dim strFrom As String           'SOURCE STRING PASSED TO FUNCTION
    Dim lngFromLength As String     'LENGTH OF SOURCE STRING
    Dim strTo As String             'DESTINATION STRING COMING FROM FUNCTION
    Dim lngToLength As Long         'LENGTH OF DESTINATION STRING
    
    strFrom = dirtystring           'STORE FUNCTION INPUT
    lngFromLength = Len(strFrom)    'GET LENGTH OF INPUT
    
    strTo = Space(lngFromLength * 2 + 1) 'ALLOCATE A BUFFER FOR OUTPUT OF FUNCTION
                                         '2 BYTES PER CHARACTER PLUS A BYTE FOR NULL
                                         'TERMINATOR USED BY FUNCTION
    
    lngToLength = api_mysql_escape_string(strTo, strFrom, lngFromLength) 'CALL API
    
    mysql_escape_string = Left(strTo, lngToLength) 'TRIM NULL TERMINATOR
End Function

strSQL = "SELECT LocationCode, TerminalCode, Source, Prefix, LastNo, Length" & _
        " FROM POS_RunningNo" & _
        " WHERE LocationCode='" & CSQLQuote(strLocationCode) & "'" & _
        " AND TerminalCode ='" & CSQLQuote(strTerminalCode) & "'" & _
        " AND Source='" & CSQLQuote(strSource) & "'"