Cannot insert single quot '' - in SQL Server from ASP.NET forms

• Sharul Nizam

  Ten Centuries

  Points: 1302

  More actions

  June 29, 2005 at 9:25 pm

  #165236

  Hi,

  I'm design my table like this.

  tablename - tblBulletin

  field - filename(varchar), title(varchar), summary(varchar)

  this in my SQL statement in ASP.NET programming (C#)

  string insert_bulletin;

  insert_bulletin = "INSERT INTO tblBulletin(filename, title, summary)";

  insert_bulletin += "('" + filename.ToString().Trim() + "',";

  insert_bulletin +="'" + txtTitle.Text.ToString().Trim() + "',";

  insert_bulletin +="'" + txtSummary.Text.ToString().Trim() + "')";

  Consider this, all data succesfully inserted, when i'm trying insert

  filename = test.html

  title = Tan Sri Dato' Hasan Kamil

  summary = why we do the process 'anihilation'

  --> my problem is MS Sql Server 2000 can't insert the title and summary because the single quot... what i should do? please help me.

• David.Poole

  SSC Guru

  Points: 76000

  More actions

  June 30, 2005 at 1:27 am

  #569686

  Replace any single quote instances with two single quotes in your variables.

  I should also use a stored procedure and use what ever the .NET equivalent of a Command object is (SQLCommand?) to pass in parameters.

  I seem to remember that .NET has a specific function that escapes dodgy characters in VARCHARS.

  LinkedIn Profile