Bruce
Thu Mar 31 18:31:12 CST 2005
You have two choices. Either write a method like this:
/// <summary>
/// Escapes the given text so that it can appear within single
quotes in a
/// <see cref="DataColumn.Expression"/>.
/// </summary>
/// <param name="textToEscape">The string to escape.</param>
/// <returns>The escaped string, ready to be included in a
/// <see cref="DataColumn.Expression"/>.</returns>
public static string EscapeText(string textToEscape)
{
string backslashesEscaped = textToEscape.Replace(@"\",
@"\\");
string backslashAndSingleQuoteEscaped =
backslashesEscaped.Replace(@"'", @"\'");
return backslashAndSingleQuoteEscaped;
}
and say
sQuery = String.Format("INSERT INTO myTable (Header, Body) VALUES
('{0}','{1}')", EscapeText(sHeader), EscapeText(sBody));
or, even better, use parameters when you're building your SQL command.
If you're using Odbc, for example, look at the OdbcParameter class.
Parameters are the preferred way to do things, because then you can
never forget to escape strings and you're not subject to SQL injection
attacks as a result. However, be forewarned that there is a bug in
.NET's ODBC support that makes decimal parameters blow up, so you have
to insert decimal values directly into the query string as you're doing.