problem with sending (') as string

[Pankaj18]

Hi, I have problem, i have designed a web page in asp.net 3.5. I have a TextBox and a button, the User is expected to write some comment in the TextBox. The TextBox can also have a comment pattern including a (') on the click of button the data in the TextBox will be inserted into SQL. Now the problem is : as you know that if u insert something in Varchar it has to be enclosed in ('), but in above case due to (') in the string itself there will be an error So, is there a way to insert the data in SQL. Thanks Pankaj

[Lost User]

Pankaj18 wrote:

So, is there a way to insert the data in SQL.

Yup, use parameterized query's;

// Update the demographics for a store, which is stored
// in an xml column.
string commandText = "UPDATE Sales.Store SET Demographics = @demographics "
+ "WHERE CustomerID = @ID;";

using (SqlConnection connection = new SqlConnection(connectionString))
{
    SqlCommand command = new SqlCommand(commandText, connection);
    command.Parameters.Add("@ID", SqlDbType.Int);
    command.Parameters\["@ID"\].Value = customerID;

    // Use AddWithValue to assign Demographics.
    // SQL Server will implicitly convert strings into XML.
    command.Parameters.AddWithValue("@demographics", demoXml);

    try
    {
        connection.Open();
        Int32 rowsAffected = command.ExecuteNonQuery();
        Console.WriteLine("RowsAffected: {0}", rowsAffected);
    }
    catch (Exception ex)
    {
        Console.WriteLine(ex.Message);
    }
}

(Sample taken from MSDN[^])

I are Troll :suss:

[David Skelly]

Use a parameterized query. http://aspnet101.com/aspnet101/tutorials.aspx?id=1[^]

[David Skelly]

Damn, if only I could type faster, I would have got there first.

[Lost User]

Next time you'll be the first to hit the submit-button, it's a small gambling machine. Anyway, I like it when a post gets (roughly) the same answer multiple times. Always a good sign if more than two developers agree on a solution :)

I are Troll :suss:

[Rob Philpott]

If you're not familiar with SQL Injection, which is a security issue, have a read about it. As others suggest you should always parameterize stuff like this rather than construct a string to do it, otherwise you might find your database missing one day...

Regards, Rob Philpott.