?
Solved

C# SQL Server Insert Embedded quotes

Posted on 2014-09-26
3
Medium Priority
?
202 Views
Last Modified: 2014-10-08
I want to do an insert into an SQL Server table but some of the variables have embeded quotes and commas

How do I insert variables that have embedded quotes and commas?

Example

strContactName = Drake, Tree, Castles  (has a comma)
strContactLocation = Tree's are Us   (has a single quote)

When I try and Insert these I get an error how do I work around it.

sql = "insert into Contacts(ContactName, ContactLocation) ";
sql = sql + " values('" + strContactName + "'," + strContactLocation + "')";
cmdw.CommandText = sql;
0
Comment
Question by:Idarac
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 35

Accepted Solution

by:
Robert Schutt earned 2000 total points
ID: 40347170
The simplest way to do this is to double up single quotes in string values (commas shouldn't be a problem, note the syntax error in your posted code, a missing quote after the comma in the value list).
sql = sql + " values('" + strContactName.Replace("'", "''") + "', '" + strContactLocation.Replace("'", "''") + "')";

Open in new window

However you may want to look into using Command parameters as that's the better way to do this:
            sql = "insert into Contacts(ContactName, ContactLocation) ";
            sql = sql + " values(@ContactName, @ContactLocation)";
            cmdw.CommandText = sql;
            cmdw.Parameters.Add(new SqlParameter("@ContactName", strContactName));
            cmdw.Parameters.Add(new SqlParameter("@ContactLocation", strContactLocation));
            cmdw.ExecuteNonQuery();

Open in new window

Now you don't have to mess with the value of your variables. Also, if you ever have to insert multiple records in the same table you don't have to change the CommandText each time, just set new values for the parameter objects and it will be faster and more efficient.
0
 
LVL 75

Expert Comment

by:käµfm³d 👽
ID: 40347579
I second the use of parameterized queries. Using string concatenation to build queries opens you up to SQL Injection attacks.
0
 
LVL 1

Author Closing Comment

by:Idarac
ID: 40369753
Thank you
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction This article series is supposed to shed some light on the use of IDisposable and objects that inherit from it. In essence, a more apt title for this article would be: using (IDisposable) {}. I’m just not sure how many people would ge…
This article is for Object-Oriented Programming (OOP) beginners. An Interface contains declarations of events, indexers, methods and/or properties. Any class which implements the Interface should provide the concrete implementation for each Inter…
This course is ideal for IT System Administrators working with VMware vSphere and its associated products in their company infrastructure. This course teaches you how to install and maintain this virtualization technology to store data, prevent vuln…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

719 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question