SQL and apostrophes

[Chris Huddle]

Normally, if you have a value in a SQL statement that contains an
apostrophe, you replace the ' with a ''. But how do you handle it in VB.NET
if you are using a DataAdapter? The SQL statements are created on the fly
by the commandbuilder and there's no way to replace the apostrophe. Surely
Microsoft has a way around this. Thanks! - Chris

 

[Hermit Dave]

Hey Chris,

Dont know bout VB.NET and i dont use command builder as such but i do use
SqlCommand and SqlParameters writing code using stored procs and params.
In my experience so far (which did surprise me at the start) was that there
was no need for nerf to use " 'my string value with apostrophe''s' ". I
could just create a SqlParameter of type nvarchar and pass it "my string
value with apostrophe's" and it just inserted it fine in the database. Tried
it with inserts and updates and it works
So i reckon it should be similar with command builder.
But get into debug mode and check the actual string before its executed by
the command object

Chao,

Hermit Dave

 

[Steve C. Orr [MVP, MCSD]]

You should use ADO.NET parameter objects. They will solve this problem and
similar problems and protect you against SQL Injection Attacks.
Here's more info:
http://msdn.microsoft.com/library/d...systemdatasqlclientsqlparameterclasstopic.asp
http://msdn.microsoft.com/library/d...ngparameterizedstoredprocedurevisualbasic.asp