Vb.Net SqlServer

N

NekoManu

Well-known member
Joined
Jul 23, 2004
Messages
75
Location
Belgium
I want to insert names into a database. Everything works fine until I want to insert a name with a quote.

My insert command is:
strSql = "Insert Into Individual (Name, FirstName) Values (" & strINDIName & ", " & strINDIFirstName & ")"

This works fine when I want to insert a name like: Cain
But it does NOT work with: OCain
 
This is how I do it:

Old:
Code: 
strSql = "Insert Into Individual (Name, FirstName) Values (" & strINDIName & ", " & strINDIFirstName & ")"

Change to:
Code: 
strSql = "Insert Into Individual (Name, FirstName) Values (" & strINDIName.Replace("", "") & ", " & strINDIFirstName.Replace("", "") & ")"
Or to clean it up:
Code: 
strSql = String.Format("Insert Into Individual (Name, FirstName) Values ({0}, {1})", _
strINDIName.Replace("", ""), _
strINDIFirstName.Replace("", ""))
 
Parameters are still a lot safer and cleaner removing the single quotes wont prevent other forms of injection attack. You are also creating extra work somewhere else - either the SQL code now needs to convert all double to single ones to store things correctly or any code that retreives these records needs to remove the duplicate character. If the data isnt only used by your app then any other applications, web pages, reports etc. are now resposible for cleaning up the returned vales.

Parameters really are safer and cleaner as solutions go.
 
Back
Top