best practive for inserting ' and " chars on database

  • Thread starter Thread starter Luminal
  • Start date Start date
L

Luminal

greetings

i'm developing an C# application using Access as database and I'm having
problems inserting data containing the ' char and the " char. What is
the best practice to insert this chars on database?

TIA

Lum
 
Lum,

You actually shouldn't be doing it at all. When you have strings that
you need to embed in your sql statements, create a parameterized query, and
then pass the string to the parameter object itself. The provider will be
responsible for handling the correct quoting for you.

It also adds security to your system overall (you won't be subject to
SQL injection attacks).

Hope this helps.
 
Hi,

wel, I think this helps, but can you give a little example or article
about parameterized queries?

Thanks

Lum
 
Luminal said:
wel, I think this helps, but can you give a little example or article
about parameterized queries?
Click to expand...

If you look up SqlCommand.Parameters in MSDN you'll find an example
there. If you're not using SQL Server, look up the equivalent for your
provider.
 
Back
Top