dealing with single quote in databases in ASP.NET pages

[SStory]

How do you guys deal with single quotes with ASP.NET and SQL Server.

I tried replacing all ' with two ' before inserting, but that shows up as
two single qutoes.

if I don't do that I get a runtime error related to this.

Just wanted some dialog on this issue. It has to be fairly common.

Thanks,

Shane

 

[Steve C. Orr [MVP, MCSD]]

You should use ADO.NET parameter objects. They will solve this problem and
similar problems and protect you against SQL Injection Attacks.
Here's more info:
http://msdn.microsoft.com/library/d...systemdatasqlclientsqlparameterclasstopic.asp
http://msdn.microsoft.com/library/d...ngparameterizedstoredprocedurevisualbasic.asp