#3 SQL values not checked for quotes

[S Vickers]

If either of the values to be set in the SQL statement in chckCurrPswd.asp (user ID and password) contain a quote character (') the statement fails. Quotes within these values need to be replaced by two quotes.