title: Changing dropdown items text before asp.net autopostback
body: <p>I am taking over a project in which a client has some annoying issues.
  They have a dropdown that autopostbacks on change to place the selected text into a t-sql query. Any value that has an apostrophe is causing an query error due to not being escaped</p>
  
  <p>I do not have access to compiled code, but was hoping to write a quick band-aid fix to on selected changed, before posting replace an apostrophe to a double apostrophe to escape it as it goes into query.</p>
  
  <p>I wrote a javscript ddl.change function that works at changing the text.</p>
  
  <p>This however is not working even though the apostrophe does change into two. I was wondering if someone could help understand why.</p>
  
  <p>I have two thoughts of scenarios causing the issue.</p>
  
  <ol>
  <li><p>On autopostback, it triggers before javascript change function does, therefore passing the original value before javascript has a change to modify it.</p></li>
  <li><p>The server side code only understands what it originally placed into the dropdown and therefore no matter how much I manipulate the client code, it will only see what it placed?</p></li>
  </ol>
  
  <p>Can anyone confirm either of these scenarios?
  Help would be appreciated!</p>
  
  <p>EDIT: I REVERSE ENGINEERED THE CODE, YES ITS VERY UGLY (AND SQL INJECTABLE) BUT IS NOT MINE AND I CANNOT MODIFY IT</p>
  
  <p>C# Code</p>
  
  <pre><code>protected void ddls_SelectedIndexChanged(object sender, EventArgs e)
      {
          if (this.ddls.SelectedIndex == 0)
          {
              this.pnlA.Visible = false;
          }
          else
          {
              this.pnlA.Visible = true;
              string text = Common.GetSql("~/Sql/" + this._Conn + "/PropertyAddressReverseSearch.sql", false, true).Split(new char[]
              {
                  Conversions.ToChar(this._Delimiter)
              })[4];
              text = string.Concat(new string[]
              {
                  "SELECT * FROM (",
                  text,
                  ") a WHERE StreetName='",
                  this.ddls.SelectedItem.Text,
                  "' "
              });
              this.Bind(this.ddla, text);
              this.ddla.Items.Insert(0, new ListItem("I'm not sure of the house number...", Conversions.ToString(-1)));
              this.ddla.Items.Insert(0, new ListItem("", Conversions.ToString(0)));
              this.map.Visible = false;
          }
      }
  </code></pre>
  
  <p>Javscript + Control</p>
  
  <pre><code>&lt;asp:dropdown runat="server" id="ddls" autopostback="true"&gt;
  &lt;script type="javascript/text"&gt;
      $(document).ready(function() {
         $("select[id$='adsearch_ddls']").change(function() {
             var ddlsValue = $("select[id$='adsearch_ddls'] option:selected").text();
              ddlsValue = ddlsValue.replace(/'/g,"\'\'");
             $("select[id$='adsearch_ddls'] option:selected").text(ddlsValue);
             return false;
         });
      });
  
  &lt;/script&gt;
  </code></pre>