Are there escape characters for SQL?

[Guest]

I think it is a very simple question, but i don't know the answer. I am
developing a web site in C# and ASP.NET . If an entry like "Here is Sam's
Pub" is entered into a Textbox exception occurs. Since " ' " character causes
problem. Are there any escape character? Or how can i solve this problem?

 

[Marina]

The single quote is its own escape character. So you would use 2 in a
string, to signify to treat it as 1 literal single quote.

It is recommended that you use parameterized queries to avoid this problem.
Most importantly that you should always use it to prevent SQL injection
attacks.

 

[Patrice]

Your quickest option is to replace ' inside the statement with ''.

Another (IMO better) option is to use parameters instead of building
statements into which you stuff values. It will avoid this problem as well
as possible formatting problems with decimal or date values caused by
writing their string representation right into the SQL statement... It helps
also to avoid SQL injection attacks...