fixing multi line text before saving to dbase

[Daves]

I am saving to database a result from multi-line textbox. The database of
course wants \x escape codes, not the invisible ones. Is there any easy -
one line code - way to do this (c#) eg by String.Format() ?

 

[Patrice]

"The database" or a dynamically created SQL statement ?

Using String.Replace should do but you could use parameters instead... IMO
the problem is that you are creating a dynamic SQL string. If you use
parametized queries you shouldn't have this problem (as line feeds will not
be part of the "SQL statement" but will just be included inside the
parameter value).

Patrice

 

[Daves]

umm not sure what you mean but it goes like

string ContentString = Textbox1.Text;

.... here I could do some ContentString.Replace() functions but I thought
maybe there would be a simple one line to do the job eg. String.Format()?
....

SQLString = "UPDATE Content='" + ContentString + "'" WHERE ...";
myCommand = new OleDbCommand(SQLSave, myConnection);
myCommand.ExecuteNonQuery();

 

[jasonkester]

... here I could do some ContentString.Replace() functions but I thought
maybe there would be a simple one line to do the job eg. String.Format()?
...

SQLString = "UPDATE Content='" + ContentString + "'" WHERE ...";
myCommand = new OleDbCommand(SQLSave, myConnection);
myCommand.ExecuteNonQuery();

As Patrice mentioned, you are having problems because you are ignoring
some Best Practices for building applications in .NET. Ideally you
should be using stored procedures:

myCommand = new SqlCommand("sp_ContentUpdate", myConnection);
myCommand.Parameters.Add("@ContentString", contentString);
myCommand.ExecuteNonQuery();

Ad hoc SQL in your code is a Bad Thing. If you absolutely must use it,
you should at least use parameterized sql:

SQLString = "UPDATE Content set ContentString = @ContentString WHERE
....";
myCommand = new SqlCommand(SQLString , myConnection);
myCommand.Parameters.Add("@ContentString", contentString);
myCommand.ExecuteNonQuery();

No more formatting your strings off the page, no more SQL Injection
attacks against your site. Check out
http://www.uberasp.net/getarticle.aspx?id=46 for more info.

Good Luck!
Jason
http://www.expatsoftware.com/

 

[Daves]

very interesting, I didn't know this! Does this mean I should also used SP
queries when not using fixed queries that is no data from a form?