how to accept single quotation mark in textbox

Question

0.00/5 (No votes)

See more:

I have a button that executes this sql query:

C#

sqlcmdInsertPhysicalNote.CommandText = "INSERT INTO DriverPhysicalNotes
(DriverInformationID, PhysicalNoteDate, PhysicalNote) VALUES ('" +
ddlDriverName.SelectedValue + "','" + DateTime.Now.ToShortDateString() +
"','" + txtNotes.Text + "')";

I am having a problem when a user enters an string between apostrophe e.g 'string' into the textbox it cause the error. THis is the error

SQL

Incorrect syntax near 'string'.

How can I keep this from happening? Quotes in the notes section should be
allowed.

Thanks,

Posted 17-Mar-14 21:16pm

Harpreet_125

Updated 17-Mar-14 21:31pm

v2

Add a Solution

3 solutions

Solution 1

can you please try to modified your code like this...

C#

sqlcmdInsertPhysicalNote.CommandText = "INSERT INTO DriverPhysicalNotes
(DriverInformationID, PhysicalNoteDate, PhysicalNote) VALUES ('" +
ddlDriverName.SelectedValue + "','" + DateTime.Now.ToShortDateString() +
"','" + txtNotes.Text.Replace("'","''") + "')";

One more thing, always be sure that, when you are giving user a text box which is accepting any string value like Memo, Notes, Description etc.. or anything at that time always tack care for ' (quot) you always need to replace it with '' (double quot).

Posted 17-Mar-14 21:21pm

Tejas Vaishnav

Updated 17-Mar-14 21:24pm

v2

Comments

Tejas Vaishnav 18-Mar-14 3:25am

if it will be solve your problem, please accept my solution as answer and also don't forget to rate it.

Harpreet_125 18-Mar-14 3:33am

i have updated my question.. please go through my question and answer me again..

Solution 4

this type of cases always use parameters.............then working fine...........

Posted 17-Mar-14 21:43pm

_Kapil

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

OriginalGriff · Accepted Answer · 2014-03-17T21:29:00

Simple: don't do it like that!
The reason it's a problem is that you are concatenating strings to form your SQL command - which is very dangerous as it allows SQL Injection attacks as well as causes syntax errors!
Use a parametrised query instead:

C#

sqlcmdInsertPhysicalNote.CommandText = "INSERT INTO DriverPhysicalNotes
(DriverInformationID, PhysicalNoteDate, PhysicalNote) VALUES (
@DM, @DT, @NT)";
sqlcmdInsertPhysicalNote.InsertCommand.Parameters.AddWithValue("@DM", ddlDriverName.SelectedValue);
sqlcmdInsertPhysicalNote.InsertCommand.Parameters.AddWithValue("@DT", DateTime.Now);
sqlcmdInsertPhysicalNote.InsertCommand.Parameters.AddWithValue("@NT", txtNotes.Text);