Escaping apostrophes inserting into sql

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

mister-Ed - 05 Oct 2007 19:33 GMT

I have a datagrid, and when initializing my field variables, I need to
double up apostrophes so they are accepted into SQL dbase. In the line
below, i'm trying to do this with the Replace function, but i still
get an error when entering an apostrophe:

Dim sCompany As String = CType(e.Item.FindControl("textbox3"),
textbox).Text.Replace("'", "''")

???
Mr. Ed

Reply to this Message

David Wier - 05 Oct 2007 20:09 GMT

Why don't you use parameterized queries, or stored Procedures?
That way, you don't need to worry about things like this, and your
application will be more secure also.

David Wier
http://aspnet101.com
http://iWritePro.com - One click PDF, convert .doc/.rtf/.txt to HTML with no
bloated markup

>I have a datagrid, and when initializing my field variables, I need to
> double up apostrophes so they are accepted into SQL dbase. In the line
[quoted text clipped - 6 lines]
> ???
> Mr. Ed

Reply to this Message

Free Magazines

Get these publications absolutely FREE for up to 12 months. There are no hidden fees and no obligation. Simply choose a title, complete the application form and submit it. Read more ...