Solved

C# SQL Server Insert Embedded quotes

Posted on 2014-09-26
3
181 Views
Last Modified: 2014-10-08
I want to do an insert into an SQL Server table but some of the variables have embeded quotes and commas

How do I insert variables that have embedded quotes and commas?

Example

strContactName = Drake, Tree, Castles  (has a comma)
strContactLocation = Tree's are Us   (has a single quote)

When I try and Insert these I get an error how do I work around it.

sql = "insert into Contacts(ContactName, ContactLocation) ";
sql = sql + " values('" + strContactName + "'," + strContactLocation + "')";
cmdw.CommandText = sql;
0
Comment
Question by:Idarac
3 Comments
 
LVL 35

Accepted Solution

by:
Robert Schutt earned 500 total points
Comment Utility
The simplest way to do this is to double up single quotes in string values (commas shouldn't be a problem, note the syntax error in your posted code, a missing quote after the comma in the value list).
sql = sql + " values('" + strContactName.Replace("'", "''") + "', '" + strContactLocation.Replace("'", "''") + "')";

Open in new window

However you may want to look into using Command parameters as that's the better way to do this:
            sql = "insert into Contacts(ContactName, ContactLocation) ";
            sql = sql + " values(@ContactName, @ContactLocation)";
            cmdw.CommandText = sql;
            cmdw.Parameters.Add(new SqlParameter("@ContactName", strContactName));
            cmdw.Parameters.Add(new SqlParameter("@ContactLocation", strContactLocation));
            cmdw.ExecuteNonQuery();

Open in new window

Now you don't have to mess with the value of your variables. Also, if you ever have to insert multiple records in the same table you don't have to change the CommandText each time, just set new values for the parameter objects and it will be faster and more efficient.
0
 
LVL 74

Expert Comment

by:käµfm³d 👽
Comment Utility
I second the use of parameterized queries. Using string concatenation to build queries opens you up to SQL Injection attacks.
0
 
LVL 1

Author Closing Comment

by:Idarac
Comment Utility
Thank you
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Introduction This article series is supposed to shed some light on the use of IDisposable and objects that inherit from it. In essence, a more apt title for this article would be: using (IDisposable) {}. I’m just not sure how many people would ge…
Summary: Persistence is the capability of an application to store the state of objects and recover it when necessary. This article compares the two common types of serialization in aspects of data access, readability, and runtime cost. A ready-to…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now