Solved

C# SQL Server Insert Embedded quotes

Posted on 2014-09-26
3
188 Views
Last Modified: 2014-10-08
I want to do an insert into an SQL Server table but some of the variables have embeded quotes and commas

How do I insert variables that have embedded quotes and commas?

Example

strContactName = Drake, Tree, Castles  (has a comma)
strContactLocation = Tree's are Us   (has a single quote)

When I try and Insert these I get an error how do I work around it.

sql = "insert into Contacts(ContactName, ContactLocation) ";
sql = sql + " values('" + strContactName + "'," + strContactLocation + "')";
cmdw.CommandText = sql;
0
Comment
Question by:Idarac
3 Comments
 
LVL 35

Accepted Solution

by:
Robert Schutt earned 500 total points
ID: 40347170
The simplest way to do this is to double up single quotes in string values (commas shouldn't be a problem, note the syntax error in your posted code, a missing quote after the comma in the value list).
sql = sql + " values('" + strContactName.Replace("'", "''") + "', '" + strContactLocation.Replace("'", "''") + "')";

Open in new window

However you may want to look into using Command parameters as that's the better way to do this:
            sql = "insert into Contacts(ContactName, ContactLocation) ";
            sql = sql + " values(@ContactName, @ContactLocation)";
            cmdw.CommandText = sql;
            cmdw.Parameters.Add(new SqlParameter("@ContactName", strContactName));
            cmdw.Parameters.Add(new SqlParameter("@ContactLocation", strContactLocation));
            cmdw.ExecuteNonQuery();

Open in new window

Now you don't have to mess with the value of your variables. Also, if you ever have to insert multiple records in the same table you don't have to change the CommandText each time, just set new values for the parameter objects and it will be faster and more efficient.
0
 
LVL 75

Expert Comment

by:käµfm³d 👽
ID: 40347579
I second the use of parameterized queries. Using string concatenation to build queries opens you up to SQL Injection attacks.
0
 
LVL 1

Author Closing Comment

by:Idarac
ID: 40369753
Thank you
0

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Video Player 2017 5 35
HttpPostedFile 1 30
Please explain the parts of these 2 LINQ expressions 3 53
C# class library debugging - Breakpoint will not hit. 8 17
Article by: Najam
Having new technologies does not mean they will completely replace old components.  Recently I had to create WCF that will be called by VB6 component.  Here I will describe what steps one should follow while doing so, please feel free to post any qu…
Introduction Hi all and welcome to my first article on Experts Exchange. A while ago, someone asked me if i could do some tutorials on object oriented programming. I decided to do them on C#. Now you may ask me, why's that? Well, one of the re…
I've attached the XLSM Excel spreadsheet I used in the video and also text files containing the macros used below. https://filedb.experts-exchange.com/incoming/2017/03_w12/1151775/Permutations.txt https://filedb.experts-exchange.com/incoming/201…

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question