asked on

c# replace double quotes

I searched hundreds of entries and tried tons of examples - I cannot find how to replace double quotes so my sql insert will run.
This runs for single quotes:
memberID = memberID.Replace("'","''");
so I need the same thing for double quotes.

Also, does a replace work on all the characters in the string or just once?

ASKER CERTIFIED SOLUTION

Jaime Olivares

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

dcass

ASKER

Will this show the double quotes back in the text like the single quote solution will?

dcass

ASKER

What other characters will interfere with an insert?
How about ampersand?

PedroBuhigas

I think what you're after is:
memberID = memberID.Replace("\"\"","other");

Jaime Olivares

I think you just have to worry about the single quote, not double quote or other.
I use to replace the single quote with a tick (`):

memberID = memberID.Replace("'","`");

Jaime Olivares

but if you want to avoid to use all these, better you use parameters instead.
have a look to:
http://www.codeproject.com/KB/database/SqlInjectionAttacks.aspx
read "Parameterised Queries" section.

carlsiy

why not use....
memberID=@memberID

SOLUTION

Tony McCreath

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

rochefc

To replace Single Quotes, Double Quotes or Carriage Returns for use with Crystal Reports in C# try

fieldValue = fieldValue.Replace("\r\n", "' & chr(010) & '").Replace("'", "''").Replace("\"", "''''");

This allows the Crystal Report to Print with the desired result