want to allow the user to enter ' but shows error
-
hi! i want user can enter single cot(')in textbox. i m using SQL yog but it display error as the insert query become ('dgfd dfg ddf_'','','',8) u can see here actually there are for paramerte but it shows error
-
hi! i want user can enter single cot(')in textbox. i m using SQL yog but it display error as the insert query become ('dgfd dfg ddf_'','','',8) u can see here actually there are for paramerte but it shows error
Your application is wide open for SQL injection attacks. Please instruct your users not to enter this in the text field:
','','',8);drop table Users;--
Alternatively, you can correct the code. Use parameterised queries instead of concatenating the data into the query.
Despite everything, the person most likely to be fooling you next is yourself.
-
Use Replace function from C# code. Something like:
TextBox1.Text.Replace("'","''");
I Love T-SQL "Don't torture yourself,let the life to do it for you." If my post helps you kindly save my time by voting my post.
Note: That is the correct way to escape a string for some specific databases, like MS SQL Server and MS Access. For other databases you need to do it differently. It's important to use the correct escaping method for the specific database, otherwise the code is still wide open for SQL injections. If you use a parameterised query instead, there is no need for escaping.
Despite everything, the person most likely to be fooling you next is yourself.
-
hi! i want user can enter single cot(')in textbox. i m using SQL yog but it display error as the insert query become ('dgfd dfg ddf_'','','',8) u can see here actually there are for paramerte but it shows error
-
Note: That is the correct way to escape a string for some specific databases, like MS SQL Server and MS Access. For other databases you need to do it differently. It's important to use the correct escaping method for the specific database, otherwise the code is still wide open for SQL injections. If you use a parameterised query instead, there is no need for escaping.
Despite everything, the person most likely to be fooling you next is yourself.
I agree with you. I just didn't have enought time to explain more in my first reply of this question. I appreciate your additional answer.
I Love T-SQL "Don't torture yourself,let the life to do it for you." If my post helps you kindly save my time by voting my post.